babelqueue 1.16.0__tar.gz → 1.16.1__tar.gz

{babelqueue-1.16.0 → babelqueue-1.16.1}/.github/workflows/ci.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches: [main]
   pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -111,6 +112,53 @@ jobs:
           AWS_SECRET_ACCESS_KEY: test
         run: pytest --cov=babelqueue --cov-report=term-missing --cov-fail-under=90
 
+  integration-live:
+    name: Integration (live Kafka)
+    # Opt-in, not a required check: runs on push to main and on demand, never on pull requests,
+    # and is deliberately NOT in ci-green's needs. (The `integration` job above is the required,
+    # coverage-gated one for Redis / RabbitMQ / SQS.)
+    if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    services:
+      kafka:
+        image: apache/kafka:3.9.0
+        ports:
+          - 9092:9092
+        env:
+          KAFKA_NODE_ID: 1
+          KAFKA_PROCESS_ROLES: broker,controller
+          KAFKA_LISTENERS: PLAINTEXT://:9092,CONTROLLER://:9093
+          KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://localhost:9092
+          KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
+          KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT
+          KAFKA_CONTROLLER_QUORUM_VOTERS: 1@localhost:9093
+          KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
+          KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
+          KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
+          KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
+        options: >-
+          --health-cmd "/opt/kafka/bin/kafka-broker-api-versions.sh --bootstrap-server localhost:9092"
+          --health-interval 10s --health-timeout 10s --health-retries 12 --health-start-period 20s
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Setup Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+
+      - name: Install (kafka extra + dev)
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[kafka,dev]"
+
+      - name: Live Kafka tests
+        env:
+          BQ_INTEGRATION: "1"
+          BQ_KAFKA_BROKERS: localhost:9092
+        run: pytest tests/test_kafka_integration.py -v
+
   conformance:
     name: Conformance suite in sync
     runs-on: ubuntu-latest
@@ -118,7 +166,7 @@ jobs:
       - uses: actions/checkout@v7
       - name: Verify vendored conformance matches the canonical suite
         run: |
-          git clone --depth 1 --branch v1.1.0 https://github.com/BabelQueue/conformance.git "$RUNNER_TEMP/conformance"
+          git clone --depth 1 --branch v1.2.0 https://github.com/BabelQueue/conformance.git "$RUNNER_TEMP/conformance"
           diff -u "$RUNNER_TEMP/conformance/CONFORMANCE_VERSION" "tests/conformance/CONFORMANCE_VERSION"
           diff -ru "$RUNNER_TEMP/conformance/manifest.json" "tests/conformance/manifest.json"
           diff -ru "$RUNNER_TEMP/conformance/fixtures"      "tests/conformance/fixtures"

{babelqueue-1.16.0 → babelqueue-1.16.1}/CHANGELOG.md

@@ -9,6 +9,27 @@ The envelope wire format is versioned separately by `meta.schema_version`
 
 ## [Unreleased]
 
+## [1.16.1] - 2026-10-11
+
+### Changed
+- **Schema-version gate rejection now dead-letters the incoming body, byte-identical.** A message
+  whose `bq-schema-version` (`bq_schema_version` on Artemis) is unsupported is rejected *without
+  decoding it* (broker-bindings §3.7/§4.7/§5.7/§6.7/§7.7) and, when the DLQ is enabled, the DLQ
+  record is the raw body as received, with no `dead_letter` block. Previously the core decoded
+  the envelope and wrote an annotated `dead_letter{reason:"unknown_urn"}` record. This aligns the
+  Python SDK with Java, .NET and Node. A DLQ consumer that expected the annotation for gated
+  messages is affected; a failed DLQ write still leaves the message unsettled (rewound on Kafka),
+  and DLQ off / `UnknownUrnStrategy.DELETE` still drops it. No wire or API change.
+
+### Fixed
+- **Kafka: a record whose settlement raised was silently lost on a consume-loop restart.** When a
+  retry / release / dead-letter `publish` failed (or the loop was otherwise interrupted before
+  `ack`), `consume()` ended with the record neither acked nor rewound while `poll` had already
+  advanced the position; the restarted loop received the *next* record and acking it committed
+  past the unsettled one (Kafka offsets are cumulative). `KafkaTransport` now remembers the
+  record `pop` handed out and re-seeks it on the next `pop` unless it was acked or rewound.
+  No API or wire change.
+
 ## [1.16.0] - 2026-10-10
 
 ### Added

{babelqueue-1.16.0 → babelqueue-1.16.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: babelqueue
-Version: 1.16.0
+Version: 1.16.1
 Summary: Polyglot Queues, Simplified — the Python core: the canonical BabelQueue wire-envelope codec, contracts and dead-letter helpers.
 Project-URL: Homepage, https://babelqueue.com
 Project-URL: Source, https://github.com/BabelQueue/babelqueue-python
@@ -186,8 +186,8 @@ ASCII whitespace) follows the normal path; any other value must be exactly `"1"`
 untrimmed; Azure Service Bus and Artemis also accept the integer `1`). A message carrying
 anything else is not decoded: it reaches the runtime on the reserved route
 `babelqueue:unsupported-schema-version:<v>` (the version percent-escaped) and is **never
-retried** — it goes straight to the dead-letter queue (reason `unknown_urn`, the body kept
-verbatim) when `dead_letter` is enabled, and is dropped otherwise, whatever `max_attempts` is.
+retried** — it goes straight to the dead-letter queue (the incoming body, byte-identical,
+with no `dead_letter` block) when `dead_letter` is enabled, and is dropped otherwise, whatever `max_attempts` is.
 It does not depend on a broker `RedrivePolicy`. If the dead-letter write fails the message is
 left unacknowledged (an error is logged), is never retried and never reaches a handler; the
 dead-letter write is attempted again when the broker brings it back, which depends on the

{babelqueue-1.16.0 → babelqueue-1.16.1}/README.md

@@ -132,8 +132,8 @@ ASCII whitespace) follows the normal path; any other value must be exactly `"1"`
 untrimmed; Azure Service Bus and Artemis also accept the integer `1`). A message carrying
 anything else is not decoded: it reaches the runtime on the reserved route
 `babelqueue:unsupported-schema-version:<v>` (the version percent-escaped) and is **never
-retried** — it goes straight to the dead-letter queue (reason `unknown_urn`, the body kept
-verbatim) when `dead_letter` is enabled, and is dropped otherwise, whatever `max_attempts` is.
+retried** — it goes straight to the dead-letter queue (the incoming body, byte-identical,
+with no `dead_letter` block) when `dead_letter` is enabled, and is dropped otherwise, whatever `max_attempts` is.
 It does not depend on a broker `RedrivePolicy`. If the dead-letter write fails the message is
 left unacknowledged (an error is logged), is never retried and never reaches a handler; the
 dead-letter write is attempted again when the broker brings it back, which depends on the

{babelqueue-1.16.0 → babelqueue-1.16.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "babelqueue"
-version = "1.16.0"
+version = "1.16.1"
 description = "Polyglot Queues, Simplified — the Python core: the canonical BabelQueue wire-envelope codec, contracts and dead-letter helpers."
 readme = "README.md"
 requires-python = ">=3.9"

{babelqueue-1.16.0 → babelqueue-1.16.1}/src/babelqueue/__init__.py

@@ -39,7 +39,7 @@ from .transport import (
     Transport,
 )
 
-__version__ = "1.16.0"
+__version__ = "1.16.1"
 
 __all__ = [
     "BabelQueue",

{babelqueue-1.16.0 → babelqueue-1.16.1}/src/babelqueue/app.py

@@ -279,7 +279,11 @@ class BabelQueue:
         with _headers_scope(received.headers), _replay_scope(
             bool(received.headers.get(HEADER_REPLAY_BYPASS))
         ):
-            envelope = EnvelopeCodec.decode(received.body)
+            # A version-gated delivery is rejected without decoding its body (broker-bindings
+            # §3.7/§4.7/§5.7/§6.7/§7.7): the raw body goes to the DLQ byte-identical, so there is
+            # no envelope to read here.
+            gated = received.route_urn.startswith(_UNSUPPORTED_SCHEMA_ROUTE_PREFIX)
+            envelope = {} if gated else EnvelopeCodec.decode(received.body)
             urn = str(envelope.get("job") or envelope.get("urn") or "")
             if received.route_urn and envelope:
                 # Transport-supplied routing override; body untouched. Only for a body that
@@ -479,7 +483,7 @@ class BabelQueue:
         # gate would be bypassed or the message would loop. It goes straight to the DLQ (or is
         # dropped when no DLQ is configured).
         if received.route_urn.startswith(_UNSUPPORTED_SCHEMA_ROUTE_PREFIX):
-            self._settle_version_gated(received, envelope)
+            self._settle_version_gated(received)
             return
         # An undecodable body or a body naming no URN can never gain a handler either, so
         # releasing it unchanged would redeliver it forever. It takes the bounded FAIL path
@@ -495,11 +499,21 @@ class BabelQueue:
         # (never kills the loop).
         raise UnknownUrnError(f"No handler mapped for URN [{urn or '(empty)'}].")
 
-    def _settle_version_gated(self, received: ReceivedMessage, envelope: Mapping[str, Any]) -> None:
-        """Dead-letter a version-gated delivery directly (no retry); drop it when no DLQ is set."""
+    def _dead_letter_target(self, received: ReceivedMessage) -> str:
+        """The queue a dead-lettered delivery is written to (configured DLQ or ``<queue><suffix>``)."""
+        return self.dead_letter_queue or (received.queue + self.dead_letter_suffix)
+
+    def _settle_version_gated(self, received: ReceivedMessage) -> None:
+        """Dead-letter a version-gated delivery directly (no retry); drop it when no DLQ is set.
+
+        The gate rejects the message *without decoding it*, so the DLQ record is the incoming raw
+        body, byte-identical, with no ``dead_letter`` block (matching the Java, .NET and Node
+        SDKs). A failed DLQ write propagates: the delivery is left unacknowledged and handed back
+        (see :meth:`dispatch`), never retried.
+        """
         if self.dead_letter_enabled or self.on_unknown_urn == UnknownUrnStrategy.DEAD_LETTER:
-            error = UnknownUrnError(f"No handler mapped for URN [{received.route_urn}].")
-            self._dead_letter(received, dict(envelope), "unknown_urn", error)
+            self._publish_for(received, self._dead_letter_target(received), received.body)
+            self._ack_settled(received)
             return
         self._ack_settled(received)
 
@@ -537,8 +551,9 @@ class BabelQueue:
             error=(str(exc) if exc is not None else None),
             exception=(type(exc).__name__ if exc is not None else None),
         )
-        target = self.dead_letter_queue or (received.queue + self.dead_letter_suffix)
-        self._publish_for(received, target, EnvelopeCodec.encode(annotated))
+        self._publish_for(
+            received, self._dead_letter_target(received), EnvelopeCodec.encode(annotated)
+        )
         self._ack_settled(received)
 
 

{babelqueue-1.16.0 → babelqueue-1.16.1}/src/babelqueue/artemis_transport.py

@@ -47,8 +47,9 @@ _logger = logging.getLogger("babelqueue.artemis")
 #: U+0085, U+00A0, U+2028, U+3000 ...
 _BLANK_ASCII_PATTERN = re.compile(r"[ \t\n\x0b\x0c\r]*")
 #: Prefix of the reserved ``route_urn`` a version-gated message is delivered under. It is not a
-#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime reports it as an
-#: unknown URN, which names the rejected ``bq_schema_version``.
+#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime dead-letters it
+#: directly (never retried, never decoded; the DLQ record is the incoming raw body). The
+#: rejected ``bq_schema_version`` is named in the logged error.
 UNSUPPORTED_SCHEMA_ROUTE_PREFIX = "babelqueue:unsupported-schema-version:"
 
 JMS_TYPE_ANNOTATION = "x-opt-jms-type"

{babelqueue-1.16.0 → babelqueue-1.16.1}/src/babelqueue/asb_transport.py

@@ -38,8 +38,9 @@ _logger = logging.getLogger("babelqueue.asb")
 #: U+0085, U+00A0, U+2028, U+3000 ...
 _BLANK_ASCII_PATTERN = re.compile(r"[ \t\n\x0b\x0c\r]*")
 #: Prefix of the reserved ``route_urn`` a version-gated message is delivered under. It is not a
-#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime reports it as an
-#: unknown URN, which names the rejected ``bq-schema-version``.
+#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime dead-letters it
+#: directly (never retried, never decoded; the DLQ record is the incoming raw body). The
+#: rejected ``bq-schema-version`` is named in the logged error.
 UNSUPPORTED_SCHEMA_ROUTE_PREFIX = "babelqueue:unsupported-schema-version:"
 
 

{babelqueue-1.16.0 → babelqueue-1.16.1}/src/babelqueue/kafka_transport.py

@@ -8,7 +8,9 @@ envelope fields onto native Kafka record headers (UTF-8 byte strings): ``bq-job`
 ``bq-source-lang`` / ``bq-attempts`` — so a Java/.NET/... peer can route on ``bq-job``
 without parsing the body — with the record timestamp mirroring ``meta.created_at``.
 Consuming is process-then-commit: ``poll`` reserves a record (``enable.auto.commit=false``)
-and ``ack`` commits the offset only after the handler returns (at-least-once). Kafka has no
+and ``ack`` commits the offset only after the handler returns (at-least-once). A record that is
+neither acked nor rewound (its settlement raised) is re-sought by the next ``pop``, so a
+restarted consume loop redelivers it instead of committing past it. Kafka has no
 native delivery count, so the ``bq-attempts`` header is the authoritative retry counter (the
 body's ``attempts`` is the fallback for non-BabelQueue producers); the runtime owns retry by
 republishing with attempts+1 and dead-letters to ``<queue>.dlq``.
@@ -38,8 +40,9 @@ _logger = logging.getLogger("babelqueue.kafka")
 #: U+0085, U+00A0, U+2028, U+3000 ...
 _BLANK_ASCII_PATTERN = re.compile(r"[ \t\n\x0b\x0c\r]*")
 #: Prefix of the reserved ``route_urn`` a version-gated message is delivered under. It is not a
-#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime reports it as an
-#: unknown URN, which names the rejected ``bq-schema-version``.
+#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime dead-letters it
+#: directly (never retried, never decoded; the DLQ record is the incoming raw body). The
+#: rejected ``bq-schema-version`` is named in the logged error.
 UNSUPPORTED_SCHEMA_ROUTE_PREFIX = "babelqueue:unsupported-schema-version:"
 
 Headers = List[Tuple[str, bytes]]
@@ -66,6 +69,8 @@ class KafkaTransport(Transport):
         self._producer = producer
         self._consumer_factory = consumer_factory
         self._consumers: Dict[str, Any] = {}
+        # Per queue: the record handed out by ``pop`` that has been neither acked nor rewound yet.
+        self._pending: Dict[str, Any] = {}
 
     # -- helpers ------------------------------------------------------------
 
@@ -197,6 +202,7 @@ class KafkaTransport(Transport):
 
     def pop(self, queue: str, timeout: float = 1.0) -> Optional[ReceivedMessage]:
         wait = timeout if timeout and timeout > 0 else 1.0
+        self._rewind_abandoned(queue)
         message = self._consumer(queue).poll(wait)
         if message is None or message.error() is not None:
             return None
@@ -215,18 +221,27 @@ class KafkaTransport(Transport):
                 unsupported,
                 SCHEMA_VERSION,
             )
-            return ReceivedMessage(
+            received = ReceivedMessage(
                 body=self._payload(message),
                 queue=queue,
                 handle=message,
                 route_urn=UNSUPPORTED_SCHEMA_ROUTE_PREFIX + quote(unsupported, safe=""),
             )
+            self._pending[queue] = message
+            return received
         body = self._reconcile(self._payload(message), headers)
-        return ReceivedMessage(body=body, queue=queue, handle=message)
+        received = ReceivedMessage(body=body, queue=queue, handle=message)
+        # Track the record as in flight only once ``pop`` has built it. A decode error above
+        # escapes before this point and must not leave the record pending: the next ``pop`` would
+        # seek back to it and fail identically, wedging the partition forever.
+        self._pending[queue] = message
+        return received
 
     def ack(self, message: ReceivedMessage) -> None:
         if message.handle is None:
             return
+        # Settled: from here on the record is no longer "in flight", whatever the commit does.
+        self._pending.pop(message.queue, None)
         self._consumer(message.queue).commit(message=message.handle, asynchronous=False)
 
     def rewind(self, message: ReceivedMessage) -> None:
@@ -236,6 +251,31 @@ class KafkaTransport(Transport):
         handle = message.handle
         if handle is None:
             return
+        self._seek_back(message.queue, handle)
+        if self._pending.get(message.queue) is handle:
+            del self._pending[message.queue]
+
+    def _rewind_abandoned(self, queue: str) -> None:
+        """Re-seek a record that ``pop`` handed out but that was never acked or rewound.
+
+        That happens when the runtime's settlement raised (a failed retry / DLQ / release
+        ``publish``): ``poll`` has already advanced the in-memory position, so without this the
+        next ``pop`` (a restarted consume loop) would return the *following* record, and acking it
+        would commit past the unsettled one — losing it. Seeking back makes it redeliver instead.
+        """
+        handle = self._pending.get(queue)
+        if handle is None:
+            return
+        try:
+            self._seek_back(queue, handle)
+        except Exception:  # noqa: BLE001 - already logged, naming the record
+            # A seek can only fail here for a partition that is no longer assigned (rebalance); the
+            # group then resets the position to the committed offset, which is that record. Do not
+            # wedge the consumer on it.
+            pass
+        self._pending.pop(queue, None)
+
+    def _seek_back(self, queue: str, handle: Any) -> None:
         try:
             from confluent_kafka import TopicPartition
         except ImportError:  # only reachable with an injected consumer
@@ -244,7 +284,7 @@ class KafkaTransport(Transport):
             TopicPartition = namedtuple("TopicPartition", "topic partition offset")  # type: ignore[misc]
         topic, partition, offset = handle.topic(), handle.partition(), handle.offset()
         try:
-            self._consumer(message.queue).seek(TopicPartition(topic, partition, offset))
+            self._consumer(queue).seek(TopicPartition(topic, partition, offset))
         except Exception:
             # Name the record so an operator can recover it by hand: if the seek fails the
             # commit of a later record on this partition may skip it.

{babelqueue-1.16.0 → babelqueue-1.16.1}/src/babelqueue/pulsar_transport.py

@@ -59,8 +59,9 @@ _BLANK_ASCII_PATTERN = re.compile(r"[ \t\n\x0b\x0c\r]*")
 #: ... that fits a signed 32-bit int, matching the Java and .NET consumers (GR-5).
 _MAX_ATTEMPTS = 2**31 - 1
 #: Prefix of the reserved ``route_urn`` a version-gated message is delivered under. It is not a
-#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime reports it as an
-#: unknown URN, which names the rejected ``bq-schema-version``.
+#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime dead-letters it
+#: directly (never retried, never decoded; the DLQ record is the incoming raw body). The
+#: rejected ``bq-schema-version`` is named in the logged error.
 UNSUPPORTED_SCHEMA_ROUTE_PREFIX = "babelqueue:unsupported-schema-version:"
 #: Separates the rejected version from the delivery's original ``bq-job`` in a gate route.
 _GATE_JOB_PARAM = "?bq-job="

{babelqueue-1.16.0 → babelqueue-1.16.1}/src/babelqueue/sqs_transport.py

@@ -54,8 +54,9 @@ logger = logging.getLogger("babelqueue.sqs")
 #: U+0085, U+00A0, U+2028, U+3000 ...
 _BLANK_ASCII_PATTERN = re.compile(r"[ \t\n\x0b\x0c\r]*")
 #: Prefix of the reserved ``route_urn`` a version-gated message is delivered under. It is not a
-#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime reports it as an
-#: unknown URN, which names the rejected ``bq-schema-version``.
+#: ``urn:babel:`` URN, so no handler can legitimately own it; the runtime dead-letters it
+#: directly (never retried, never decoded; the DLQ record is the incoming raw body). The
+#: rejected ``bq-schema-version`` is named in the logged error.
 UNSUPPORTED_SCHEMA_ROUTE_PREFIX = "babelqueue:unsupported-schema-version:"
 
 

babelqueue-1.16.1/tests/conformance/CONFORMANCE_VERSION

@@ -0,0 +1 @@
+1.2.0

{babelqueue-1.16.0 → babelqueue-1.16.1}/tests/conformance/manifest.json

@@ -222,7 +222,7 @@
       ]
     },
     "schema_version_gate": {
-      "description": "Consumer-side schema-version gate (broker-bindings.md §4.7). The consumer MUST read the ASB ApplicationProperties entry `bq-schema-version` BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate. ASB application properties are AMQP-typed, so the JSON-number cases (a number, not a string) stand for a native AMQP number: any AMQP integral type (byte/short/int/long, signed or unsigned) with value 1 decodes; any other numeric value (2, 0, non-integral 1.5) and any other type rejects. JSON numbers carry no width, so a runner MUST exercise integral 1 and 2 at both int32 and int64 width. A floating-point 1.0 is unspecified and not tested.",
+      "description": "Consumer-side schema-version gate (broker-bindings.md §4.7). The consumer MUST read the ASB ApplicationProperties entry `bq-schema-version` BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate. ASB application properties are AMQP-typed, so the JSON-number cases (a number, not a string) stand for a native AMQP number: any AMQP integral type (byte/short/int/long, signed or unsigned) with value 1 decodes; any other numeric value (2, 0, non-integral 1.5) and any other type rejects. JSON numbers carry no width, so a runner MUST exercise integral 1 and 2 at both int32 and int64 width. A floating-point 1.0 is a native AMQP float/double, NOT integral 1, and rejects: because JSON parsers in several languages (Go, Node) cannot tell 1.0 from 1, that case carries an explicit 'value_type': 'float' marker and a runner MUST hand the SDK a real floating-point value (float32 and float64 where the language has both), never an integer. A language with a single number type (JavaScript: AMQP float 1.0 arrives as the number 1) cannot represent the case and its runner skips it explicitly. A case without 'value_type' keeps the plain meaning above. A JSON null 'value' stands for a present-but-null application property: it is treated exactly like an absent one (the property is simply not set) and decodes, so the runner MUST put the property key into the message with a null value rather than omit it.",
       "property": "bq-schema-version",
       "fixture": "fixtures/order-created.json",
       "cases": [
@@ -247,7 +247,9 @@
         { "value": 1,               "expect": "decode" },
         { "value": 2,               "expect": "reject" },
         { "value": 0,               "expect": "reject" },
-        { "value": 1.5,             "expect": "reject" }
+        { "value": 1.5,             "expect": "reject" },
+        { "value": 1.0, "value_type": "float", "expect": "reject" },
+        { "value": null,            "expect": "decode" }
       ]
     }
   },
@@ -327,7 +329,7 @@
       ]
     },
     "schema_version_gate": {
-      "description": "Consumer-side schema-version gate (broker-bindings.md §6.7). The consumer MUST read the Kafka record header `bq-schema-version` BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate.",
+      "description": "Consumer-side schema-version gate (broker-bindings.md §6.7). The consumer MUST read the Kafka record header `bq-schema-version` BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate. A JSON null 'value' stands for a present-but-null Kafka record header (Kafka allows a null header value): it is treated exactly like an absent one (the header carries no version) and decodes, so the runner MUST put the header key into the record with a null value rather than omit it, and an SDK MUST NOT stringify the null (a header whose value became the text \"null\" would be rejected).",
       "property": "bq-schema-version",
       "fixture": "fixtures/order-created.json",
       "cases": [
@@ -348,7 +350,8 @@
         { "value": "\u3000",       "expect": "reject" },
         { "value": "\ufeff",       "expect": "reject" },
         { "value": "\u00a01",      "expect": "reject" },
-        { "value": "1\u3000",      "expect": "reject" }
+        { "value": "1\u3000",      "expect": "reject" },
+        { "value": null,            "expect": "decode" }
       ]
     }
   },
@@ -379,7 +382,7 @@
       ]
     },
     "schema_version_gate": {
-      "description": "Consumer-side schema-version gate (broker-bindings.md §7.7). The consumer MUST read the Artemis application property `bq_schema_version` (underscores, ADR-0017) BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate.",
+      "description": "Consumer-side schema-version gate (broker-bindings.md §7.7). The consumer MUST read the Artemis application property `bq_schema_version` (underscores, ADR-0017) BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate. A JSON null 'value' stands for a present-but-null application property: it is treated exactly like an absent one (the property carries no version) and decodes, so the runner MUST put the property key into the message with a null value rather than omit it. A reader whose message API cannot carry a null application property MUST skip this case explicitly (and assert that it skips) rather than silently drop it.",
       "property": "bq_schema_version",
       "fixture": "fixtures/order-created.json",
       "cases": [
@@ -400,7 +403,8 @@
         { "value": "\u3000",       "expect": "reject" },
         { "value": "\ufeff",       "expect": "reject" },
         { "value": "\u00a01",      "expect": "reject" },
-        { "value": "1\u3000",      "expect": "reject" }
+        { "value": "1\u3000",      "expect": "reject" },
+        { "value": null,            "expect": "decode" }
       ]
     }
   },

babelqueue-1.16.1/tests/fakes/confluent_kafka/__init__.py

@@ -0,0 +1,73 @@
+"""In-process stand-in for the slice of confluent_kafka the live tests and KafkaTransport use.
+
+Single partition per topic, per-group committed offsets, cumulative commit, seek, and
+position-from-committed on a new consumer — the semantics the transport relies on."""
+import threading
+
+_LOCK = threading.RLock()
+TOPICS = {}      # topic -> list[Message]
+COMMITTED = {}   # (group, topic) -> next offset to read
+
+
+class TopicPartition:
+    def __init__(self, topic, partition=0, offset=-1001):
+        self.topic, self.partition, self.offset = topic, partition, offset
+
+
+class Message:
+    def __init__(self, topic, offset, value, headers):
+        self._t, self._o, self._v, self._h = topic, offset, value, headers
+
+    def value(self): return self._v
+    def headers(self): return self._h
+    def error(self): return None
+    def topic(self): return self._t
+    def partition(self): return 0
+    def offset(self): return self._o
+
+
+class Producer:
+    def __init__(self, conf): pass
+
+    def produce(self, topic, value=None, headers=None, timestamp=None, **kw):
+        with _LOCK:
+            log = TOPICS.setdefault(topic, [])  # auto-create, like the real broker default
+            log.append(Message(topic, len(log), value, list(headers or [])))
+
+    def poll(self, t): return 0
+    def flush(self, *a): return 0
+
+
+class Consumer:
+    def __init__(self, conf):
+        self.group = conf["group.id"]
+        self.topic = None
+        self.position = None
+
+    def subscribe(self, topics):
+        self.topic = topics[0]
+        self.position = COMMITTED.get((self.group, self.topic), 0)
+
+    def poll(self, timeout=None):
+        with _LOCK:
+            log = TOPICS.get(self.topic, [])
+            if self.position < len(log):
+                m = log[self.position]
+                self.position += 1
+                return m
+        import time
+        time.sleep(min(timeout or 0.05, 0.05))
+        return None
+
+    def commit(self, message=None, asynchronous=True):
+        with _LOCK:
+            key = (self.group, message.topic())
+            COMMITTED[key] = max(COMMITTED.get(key, 0), message.offset() + 1)
+
+    def seek(self, tp):
+        self.position = tp.offset
+
+    def committed(self, partitions, timeout=None):
+        return [TopicPartition(p.topic, p.partition, COMMITTED.get((self.group, p.topic), -1001)) for p in partitions]
+
+    def close(self): pass

babelqueue-1.16.1/tests/fakes/confluent_kafka/admin.py

@@ -0,0 +1,20 @@
+import concurrent.futures
+from . import TOPICS, _LOCK
+
+
+class NewTopic:
+    def __init__(self, name, **kw): self.name = name
+
+
+class AdminClient:
+    def __init__(self, conf): pass
+
+    def create_topics(self, topics):
+        out = {}
+        for t in topics:
+            with _LOCK:
+                TOPICS.setdefault(t.name, [])
+            f = concurrent.futures.Future()
+            f.set_result(None)
+            out[t.name] = f
+        return out

{babelqueue-1.16.0 → babelqueue-1.16.1}/tests/test_app.py

@@ -265,9 +265,11 @@ class AppTest(unittest.TestCase):
                     self.assertEqual(seen, [])  # never reaches the handler
                     self.assertEqual(app.transport.size("orders"), 0)
                     self.assertEqual(app.transport.size("orders.dlq"), 1)
-                    dead = EnvelopeCodec.decode(app.transport._queues["orders.dlq"][0])  # noqa: SLF001
-                    self.assertEqual(dead["dead_letter"]["reason"], "unknown_urn")
-                    self.assertIn(route, dead["dead_letter"]["error"])
+                    # The gate rejects without decoding: the DLQ record is the incoming raw body,
+                    # byte-identical, with no dead_letter block (even for an undecodable body).
+                    dead = app.transport._queues["orders.dlq"][0]  # noqa: SLF001
+                    self.assertEqual(dead, body)
+                    self.assertNotIn("dead_letter", dead)
 
     def test_version_gated_message_whose_dead_letter_write_fails_is_not_retried(self) -> None:
         from babelqueue.app import _UNSUPPORTED_SCHEMA_ROUTE_PREFIX

{babelqueue-1.16.0 → babelqueue-1.16.1}/tests/test_artemis_transport.py

@@ -301,7 +301,8 @@ class ArtemisSchemaVersionGateTest(unittest.TestCase):
         # max_attempts > 1: a gated message is dead-lettered directly, never retried
         for value in ("2", "x", "2&x=%"):
             with self.subTest(value=value):
-                transport, receiver = self._transport(body(), {"bq_schema_version": value})
+                incoming = body()
+                transport, receiver = self._transport(incoming, {"bq_schema_version": value})
                 app = BabelQueue(transport=transport, max_attempts=5, dead_letter=True)
                 seen: list = []
 
@@ -318,10 +319,9 @@ class ArtemisSchemaVersionGateTest(unittest.TestCase):
                 publish.assert_called_once()
                 queue, dead_body = publish.call_args.args
                 self.assertEqual("orders.dlq", queue)
-                dead = EnvelopeCodec.decode(dead_body)
-                self.assertEqual(URN, dead["job"])  # the producer's body, annotated
-                self.assertEqual("unknown_urn", dead["dead_letter"]["reason"])
-                self.assertIn(self.PREFIX + quote(value, safe=""), dead["dead_letter"]["error"])
+                # rejected without decoding: the DLQ record is the incoming body, byte-identical
+                self.assertEqual(incoming, dead_body)
+                self.assertNotIn("dead_letter", dead_body)
 
 
 class ArtemisUrlTest(unittest.TestCase):

{babelqueue-1.16.0 → babelqueue-1.16.1}/tests/test_asb_conformance.py

@@ -65,6 +65,9 @@ class AsbConformanceTest(unittest.TestCase):
         self.assertEqual(EnvelopeCodec.decode(valid_body)["job"], "urn:babel:orders:created")
 
         for case in gate["cases"]:
+            if case.get("value_type") == "float":
+                # An explicit floating-point case (e.g. 1.0): the reader must hand over a real float.
+                self.assertIsInstance(case["value"], float, "schema_version_gate case %r" % (case,))
             carrier = self._gate_carrier(case)
             rejected = AsbTransport._unsupported_schema_version(carrier)
             want = "reject" if case["expect"] == "reject" else "decode"

{babelqueue-1.16.0 → babelqueue-1.16.1}/tests/test_asb_transport.py

@@ -277,7 +277,8 @@ class AsbSchemaVersionGateTest(unittest.TestCase):
         # max_attempts > 1: a gated message is dead-lettered directly, never retried
         for value in ("2", "x", 2, "2&x=%"):
             with self.subTest(value=value):
-                receiver = FakeReceiver([FakeReceived(body(), 1, {"bq-schema-version": value})])
+                incoming = body()
+                receiver = FakeReceiver([FakeReceived(incoming, 1, {"bq-schema-version": value})])
                 app = BabelQueue(
                     transport=AsbTransport(client=FakeClient(receiver=receiver)),
                     max_attempts=5,
@@ -298,10 +299,9 @@ class AsbSchemaVersionGateTest(unittest.TestCase):
                 publish.assert_called_once()
                 queue, dead_body = publish.call_args.args
                 self.assertEqual(queue, "orders.dlq")
-                dead = EnvelopeCodec.decode(dead_body)
-                self.assertEqual(dead["job"], URN)  # the producer's body, annotated
-                self.assertEqual(dead["dead_letter"]["reason"], "unknown_urn")
-                self.assertIn(self.PREFIX + quote(str(value), safe=""), dead["dead_letter"]["error"])
+                # rejected without decoding: the DLQ record is the incoming body, byte-identical
+                self.assertEqual(dead_body, incoming)
+                self.assertNotIn("dead_letter", dead_body)
 
 
 @unittest.skipUnless(HAVE_ASB, "azure-servicebus not installed")

{babelqueue-1.16.0 → babelqueue-1.16.1}/tests/test_kafka_conformance.py

@@ -52,6 +52,8 @@ class KafkaConformanceTest(unittest.TestCase):
     def _gate_carrier(self, case: dict):
         if "absent" in case:
             return []
+        if case["value"] is None:  # JSON null: header present with a null value == absent (§6.7)
+            return [(self.gate["property"], None)]
         return [(self.gate["property"], case["value"].encode("utf-8"))]
 
     def test_schema_version_gate(self) -> None: