Repository navigation
Expand file tree
/
Copy pathmanifest.json
More file actions
9897 lines (9897 loc) · 428 KB
/
Copy pathmanifest.json
File metadata and controls
9897 lines (9897 loc) · 428 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
{
"schema_version": 1,
"conformance_version": "1.10.0",
"sections": {
"cases": {
"scope": "core"
},
"idempotency": {
"scope": "core"
},
"sqs": {
"scope": "sqs"
},
"asb": {
"scope": "asb"
},
"pulsar": {
"scope": "pulsar"
},
"kafka": {
"scope": "kafka"
},
"artemis": {
"scope": "artemis"
},
"redis": {
"scope": "redis"
},
"rabbitmq": {
"scope": "amqp"
},
"payload_schema": {
"scope": "core"
},
"roundtrip": {
"scope": "core"
},
"data_shape": {
"scope": "core"
},
"forbidden_keys": {
"scope": "core"
},
"extension_write": {
"scope": "core"
},
"encode_reject": {
"scope": "core"
},
"payload_schema_unicode": {
"scope": "core"
},
"payload_schema_keywords": {
"scope": "core"
},
"trim": {
"scope": "core"
},
"job_type": {
"scope": "core"
},
"traceparent": {
"scope": "otel"
},
"delay": {
"scope": "sqs"
},
"backoff": {
"scope": "kafka"
},
"retry_backoff": {
"scope": "core"
},
"redis_layout": {
"scope": "redis"
},
"redis_delay": {
"scope": "redis"
},
"kafka_poison": {
"scope": "kafka"
},
"poison_dlq": {
"scope": "core"
},
"identity_verdict": {
"scope": "core"
},
"pulsar_exhaustion": {
"scope": "pulsar"
},
"version_gate_pulsar": {
"scope": "pulsar"
},
"version_gate_artemis": {
"scope": "artemis"
},
"version_gate_sqs": {
"scope": "sqs"
},
"version_gate_asb": {
"scope": "asb"
},
"span-shape": {
"scope": "otel"
},
"trace-id": {
"scope": "otel"
},
"metrics": {
"scope": "otel"
}
},
"exceptions": [
{
"family": "php",
"binding": "asb",
"adr": "ADR-0021"
}
],
"description": "Cross-SDK conformance cases. Every BabelQueue SDK core must satisfy these against the canonical wire envelope. Per-message fields (meta.id, trace_id, meta.created_at) are intrinsically unique and are NOT asserted by value.",
"cases": [
{
"name": "order-created",
"file": "fixtures/order-created.json",
"valid": true,
"description": "A normal produced envelope.",
"expect": {
"urn": "urn:babel:orders:created",
"data": { "order_id": 1042 },
"attempts": 0,
"lang": "php",
"schema_version": 1
}
},
{
"name": "urn-alias",
"file": "fixtures/urn-alias.json",
"valid": true,
"description": "Consumers MUST accept 'urn' as an inbound alias for 'job'.",
"expect": {
"urn": "urn:babel:orders:created",
"data": { "order_id": 1042 },
"attempts": 0,
"lang": "go",
"schema_version": 1
}
},
{
"name": "dead-lettered",
"file": "fixtures/dead-lettered.json",
"valid": true,
"description": "A dead-lettered message: original preserved + additive dead_letter block.",
"expect": {
"urn": "urn:babel:orders:created",
"data": { "order_id": 1042 },
"attempts": 3,
"lang": "php",
"schema_version": 1,
"dead_letter": { "reason": "failed", "original_queue": "orders" }
}
},
{
"name": "unicode-and-numbers",
"file": "fixtures/unicode-and-numbers.json",
"valid": true,
"description": "UTF-8 strings, integers, an exact float, boolean and null round-trip identically.",
"expect": {
"urn": "urn:babel:catalog:item.indexed",
"data": { "title": "Café — naïve ☕", "qty": 7, "price_cents": 1299, "ratio": 0.5, "active": true, "note": null },
"attempts": 2,
"lang": "python",
"schema_version": 1
}
},
{
"name": "invalid-unknown-schema-version",
"file": "fixtures/invalid-unknown-schema-version.json",
"valid": false,
"reason": "meta.schema_version is not a version this SDK supports"
},
{
"name": "invalid-missing-urn",
"file": "fixtures/invalid-missing-urn.json",
"valid": false,
"reason": "no 'job' or 'urn' — the message has no identity"
},
{
"name": "invalid-wrong-case-job",
"file": "fixtures/invalid-wrong-case-job.json",
"valid": false,
"reason": "envelope keys are case-sensitive: 'JOB' is an unknown key, so there is no 'job' or 'urn' and the message has no identity"
},
{
"name": "duplicate-keys-last-wins",
"file": "fixtures/duplicate-keys-last-wins.json",
"valid": true,
"description": "A repeated envelope key follows last-wins and is never merged: the second 'job' and the second 'data' object replace the first (RFC 8259 leaves duplicates undefined; every SDK resolves them the same way).",
"expect": {
"urn": "urn:babel:orders:created",
"data": { "order_id": 1042 },
"attempts": 0,
"lang": "php",
"schema_version": 1
}
}
],
"idempotency": {
"description": "Consumer idempotency conformance (ADR-0022). Broker-free: locks the seen-set dedupe contract every SDK's optional idempotency helper (Go idempotency.Wrap, PHP Idempotent::wrap, Python idempotency.wrap, Node Wrap, Java Idempotent.wrap) MUST honour over the frozen schema_version-1 envelope, independent of any transport. The helper does NOT touch the wire envelope — the cases above stay byte-identical; this block governs the consume-side decision (run the handler, or skip-and-ack) keyed on meta.id.",
"dedup_key": {
"description": "The dedupe key is meta.id verbatim — the canonical per-message identity (distinct from trace_id, which spans a causal chain). A consumer MUST key its seen-set on exactly fixtures/order-created.json's meta.id; two deliveries with the same meta.id are the SAME message (a redelivery), even byte-for-byte identical, and dedupe to one effect. trace_id is NOT the key: messages sharing a trace_id but with distinct meta.id are distinct effects.",
"envelope_file": "fixtures/order-created.json",
"key_field": "meta.id",
"expected_key": "f1e2d3c4-b5a6-4789-90ab-cdef01234567"
},
"sequences": {
"description": "Each sequence drives ONE handler wrapped by the SDK's idempotency helper, backed by ONE seen-set store, through an ordered list of deliveries. For each delivery the SDK MUST derive the effect: 'run' = the wrapped handler is invoked (the side-effect fires) and, on its outcome 'ok', the id is remembered; 'skip' = an already-remembered id is recognised, the handler is NOT invoked, and the delivery is acked (the runtime stops redelivering). 'outcome' is the handler's result for a 'run' delivery: 'ok' = returns/acks (remembered), 'throw' = raises/errors (the id is left UNMARKED so a later redelivery runs it again — retry/DLQ still apply). After replaying the whole sequence, total 'run'+'ok' invocations MUST equal expected_effects. This is at-least-once delivery collapsed to an exactly-once EFFECT by the consumer; it is seen-set post-success dedupe, NOT exactly-once delivery and NOT an in-flight concurrency lock.",
"cases": [
{
"name": "duplicate-delivery-runs-once",
"description": "The same meta.id delivered twice (a textbook at-least-once redelivery): first runs the effect, second is skipped. One effect.",
"deliveries": [
{ "meta_id": "id-A", "expect_effect": "run", "outcome": "ok" },
{ "meta_id": "id-A", "expect_effect": "skip" }
],
"expected_effects": 1
},
{
"name": "at-least-once-redelivery-is-noop",
"description": "Three redeliveries of one id (a flaky broker / worker-crash-before-ack storm): the effect fires once; every subsequent redelivery is a no-op skip.",
"deliveries": [
{ "meta_id": "id-A", "expect_effect": "run", "outcome": "ok" },
{ "meta_id": "id-A", "expect_effect": "skip" },
{ "meta_id": "id-A", "expect_effect": "skip" },
{ "meta_id": "id-A", "expect_effect": "skip" }
],
"expected_effects": 1
},
{
"name": "distinct-ids-each-run",
"description": "Different meta.ids are different messages — each runs once. Dedupe is per-id, never collapses unrelated messages.",
"deliveries": [
{ "meta_id": "id-A", "expect_effect": "run", "outcome": "ok" },
{ "meta_id": "id-B", "expect_effect": "run", "outcome": "ok" },
{ "meta_id": "id-C", "expect_effect": "run", "outcome": "ok" }
],
"expected_effects": 3
},
{
"name": "throw-leaves-id-unmarked",
"description": "A handler that throws does NOT remember the id, so the next redelivery runs it again (retry semantics survive the guard). The third delivery succeeds and is then deduped on a fourth.",
"deliveries": [
{ "meta_id": "id-A", "expect_effect": "run", "outcome": "throw" },
{ "meta_id": "id-A", "expect_effect": "run", "outcome": "throw" },
{ "meta_id": "id-A", "expect_effect": "run", "outcome": "ok" },
{ "meta_id": "id-A", "expect_effect": "skip" }
],
"expected_effects": 3
},
{
"name": "missing-id-fails-open",
"description": "A message with no usable meta.id (empty/absent) CANNOT be deduped, so the helper fails open: every delivery runs the handler. The guard never silently drops work it cannot identify.",
"deliveries": [
{ "meta_id": "", "expect_effect": "run", "outcome": "ok" },
{ "meta_id": "", "expect_effect": "run", "outcome": "ok" }
],
"expected_effects": 2
},
{
"name": "forget-allows-rerun",
"description": "forget(id) evicts an id from the seen-set, so a later delivery of that id runs again (manual replay / TTL expiry). Locks the third Store method.",
"deliveries": [
{ "meta_id": "id-A", "expect_effect": "run", "outcome": "ok" },
{ "meta_id": "id-A", "expect_effect": "skip" },
{ "meta_id": "id-A", "forget_before": true, "expect_effect": "run", "outcome": "ok" }
],
"expected_effects": 2
}
]
}
},
"sqs": {
"description": "Amazon SQS binding conformance (broker-bindings.md §3). Every SDK that ships an SQS transport must satisfy these. The envelope body stays byte-identical (the 'cases' above); these lock the native projection + reconciliation the binding adds. Per-message values reuse fixtures/order-created.json so the expected attributes are deterministic.",
"attribute_projection": {
"description": "On produce, the transport MUST project these native MessageAttributes from the envelope (a redundant, routable view of the body; ids/strings are DataType String, counters are DataType Number). Applies to every SQS-producing SDK.",
"envelope_file": "fixtures/order-created.json",
"message_attributes": {
"bq-job": { "DataType": "String", "StringValue": "urn:babel:orders:created" },
"bq-trace-id": { "DataType": "String", "StringValue": "7b3f9c2a-e41d-4f88-9b2a-1c0d5e6f7a8b" },
"bq-message-id": { "DataType": "String", "StringValue": "f1e2d3c4-b5a6-4789-90ab-cdef01234567" },
"bq-schema-version": { "DataType": "Number", "StringValue": "1" },
"bq-source-lang": { "DataType": "String", "StringValue": "php" },
"bq-created-at": { "DataType": "Number", "StringValue": "1749132727000" }
}
},
"attempts_reconciliation": {
"description": "On consume, attempts = max(body.attempts, ApproximateReceiveCount - 1): a first delivery reads 0, an absent/garbage count is ignored, a runtime-incremented count is never lowered. Applies to SDKs that reconcile the envelope body on consume (the framework-less/runtime transports). A drop-in driver that surfaces the broker's native delivery count instead (e.g. Laravel's SqsJob.attempts() = ApproximateReceiveCount) is exempt — it documents that divergence.",
"cases": [
{ "name": "first-delivery", "body_attempts": 0, "approximate_receive_count": "1", "expected_attempts": 0 },
{ "name": "third-delivery", "body_attempts": 0, "approximate_receive_count": "3", "expected_attempts": 2 },
{ "name": "native-exceeds-body", "body_attempts": 2, "approximate_receive_count": "5", "expected_attempts": 4 },
{ "name": "never-lower-runtime", "body_attempts": 5, "approximate_receive_count": "1", "expected_attempts": 5 },
{ "name": "garbage-count-ignored", "body_attempts": 4, "approximate_receive_count": "not-a-number", "expected_attempts": 4 },
{ "name": "absent-count", "body_attempts": 3, "approximate_receive_count": null, "expected_attempts": 3 }
]
},
"schema_version_gate": {
"description": "Consumer-side schema-version gate (broker-bindings.md §3.7). The consumer MUST read the SQS message attribute `bq-schema-version` BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate.",
"property": "bq-schema-version",
"fixture": "fixtures/order-created.json",
"cases": [
{ "value": "1", "expect": "decode" },
{ "value": "", "expect": "decode" },
{ "value": " \t", "expect": "decode" },
{ "value": " ", "expect": "decode" },
{ "value": "\n\u000b\f\r", "expect": "decode" },
{ "absent": true, "expect": "decode" },
{ "value": "2", "expect": "reject" },
{ "value": "01", "expect": "reject" },
{ "value": "x", "expect": "reject" },
{ "value": " 1", "expect": "reject" },
{ "value": "1 ", "expect": "reject" },
{ "value": "\t1\n", "expect": "reject" },
{ "value": "\u00a0", "expect": "reject" },
{ "value": "\u0085", "expect": "reject" },
{ "value": "\u3000", "expect": "reject" },
{ "value": "\ufeff", "expect": "reject" },
{ "value": "\u00a01", "expect": "reject" },
{ "value": "1\u3000", "expect": "reject" }
]
}
},
"asb": {
"description": "Azure Service Bus binding conformance (broker-bindings.md §4). Every SDK that ships an ASB transport must satisfy these. The envelope body stays byte-identical (the 'cases' above); these lock the native projection + reconciliation the binding adds. Per-message values reuse fixtures/order-created.json so the expected projection is deterministic.",
"property_projection": {
"description": "On produce, the transport MUST project these native Service Bus message fields from the envelope: Subject = job (the URN), CorrelationId = trace_id, MessageId = meta.id, ContentType = application/json, plus the bq- ApplicationProperties as native AMQP-typed values (numbers stay numbers, not strings). Applies to every ASB-producing SDK.",
"envelope_file": "fixtures/order-created.json",
"message": {
"subject": "urn:babel:orders:created",
"correlation_id": "7b3f9c2a-e41d-4f88-9b2a-1c0d5e6f7a8b",
"message_id": "f1e2d3c4-b5a6-4789-90ab-cdef01234567",
"content_type": "application/json"
},
"application_properties": {
"bq-schema-version": 1,
"bq-source-lang": "php",
"bq-created-at": 1749132727000
}
},
"attempts_reconciliation": {
"description": "On consume, attempts = max(body.attempts, DeliveryCount - 1): a first delivery (DeliveryCount 1) reads 0, a runtime-incremented body count is never lowered, and DeliveryCount <= 1 leaves the body's own count untouched (the runtime retries by republishing with attempts+1). DeliveryCount is the native 1-based ASB redelivery counter; the rule is identical across the native-consumer SDKs (.NET/Java/Node) and the Transport+App SDKs (Python/Go).",
"cases": [
{ "name": "first-delivery", "body_attempts": 0, "delivery_count": 1, "expected_attempts": 0 },
{ "name": "third-delivery", "body_attempts": 0, "delivery_count": 3, "expected_attempts": 2 },
{ "name": "native-exceeds-body", "body_attempts": 2, "delivery_count": 5, "expected_attempts": 4 },
{ "name": "never-lower-runtime", "body_attempts": 5, "delivery_count": 2, "expected_attempts": 5 },
{ "name": "first-delivery-keeps-body", "body_attempts": 4, "delivery_count": 1, "expected_attempts": 4 },
{ "name": "zero-count-keeps-body", "body_attempts": 3, "delivery_count": 0, "expected_attempts": 3 }
]
},
"schema_version_gate": {
"description": "Consumer-side schema-version gate (broker-bindings.md §4.7). The consumer MUST read the ASB ApplicationProperties entry `bq-schema-version` BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate. ASB application properties are AMQP-typed, so the JSON-number cases (a number, not a string) stand for a native AMQP number: any AMQP integral type (byte/short/int/long, signed or unsigned) with value 1 decodes; any other numeric value (2, 0, non-integral 1.5) and any other type rejects. JSON numbers carry no width, so a runner MUST exercise integral 1 and 2 at both int32 and int64 width. A floating-point 1.0 is a native AMQP float/double, NOT integral 1, and rejects: because JSON parsers in several languages (Go, Node) cannot tell 1.0 from 1, that case carries an explicit 'value_type': 'float' marker and a runner MUST hand the SDK a real floating-point value (float32 and float64 where the language has both), never an integer. A language with a single number type (JavaScript: AMQP float 1.0 arrives as the number 1) cannot represent the case and its runner skips it explicitly. A case without 'value_type' keeps the plain meaning above. A JSON null 'value' stands for a present-but-null application property: it is treated exactly like an absent one (the property is simply not set) and decodes, so the runner MUST put the property key into the message with a null value rather than omit it.",
"property": "bq-schema-version",
"fixture": "fixtures/order-created.json",
"cases": [
{ "value": "1", "expect": "decode" },
{ "value": "", "expect": "decode" },
{ "value": " \t", "expect": "decode" },
{ "value": " ", "expect": "decode" },
{ "value": "\n\u000b\f\r", "expect": "decode" },
{ "absent": true, "expect": "decode" },
{ "value": "2", "expect": "reject" },
{ "value": "01", "expect": "reject" },
{ "value": "x", "expect": "reject" },
{ "value": " 1", "expect": "reject" },
{ "value": "1 ", "expect": "reject" },
{ "value": "\t1\n", "expect": "reject" },
{ "value": "\u00a0", "expect": "reject" },
{ "value": "\u0085", "expect": "reject" },
{ "value": "\u3000", "expect": "reject" },
{ "value": "\ufeff", "expect": "reject" },
{ "value": "\u00a01", "expect": "reject" },
{ "value": "1\u3000", "expect": "reject" },
{ "value": 1, "expect": "decode" },
{ "value": 2, "expect": "reject" },
{ "value": 0, "expect": "reject" },
{ "value": 1.5, "expect": "reject" },
{ "value": 1.0, "value_type": "float", "expect": "reject" },
{ "value": null, "expect": "decode" }
]
}
},
"pulsar": {
"description": "Apache Pulsar binding conformance (broker-bindings.md §5). Every SDK that ships a Pulsar transport must satisfy these. The envelope body stays byte-identical (the 'cases' above); these lock the native projection + reconciliation the binding adds. Per-message values reuse fixtures/order-created.json so the expected projection is deterministic.",
"property_projection": {
"description": "On produce, the transport MUST project these native Pulsar message properties from the envelope, all string->string (Pulsar properties are string-typed, so numbers are stringified): bq-job = job (the URN), bq-trace-id = trace_id, bq-message-id = meta.id, bq-schema-version = str(meta.schema_version), bq-source-lang = meta.lang, bq-attempts = str(attempts). The payload is the byte-identical envelope; the native publishTime mirrors meta.created_at (broker-set, body authoritative). Applies to every Pulsar-producing SDK.",
"envelope_file": "fixtures/order-created.json",
"properties": {
"bq-job": "urn:babel:orders:created",
"bq-trace-id": "7b3f9c2a-e41d-4f88-9b2a-1c0d5e6f7a8b",
"bq-message-id": "f1e2d3c4-b5a6-4789-90ab-cdef01234567",
"bq-schema-version": "1",
"bq-source-lang": "php",
"bq-attempts": "0"
}
},
"attempts_reconciliation": {
"description": "On consume, attempts = max(body.attempts, RedeliveryCount): Pulsar's RedeliveryCount is 0-based (0 on first delivery) so it maps directly with NO -1, a runtime-incremented body count is never lowered, and RedeliveryCount 0 leaves the body's own count untouched (the runtime retries by republishing with attempts+1, which resets the broker's redelivery count to 0). The rule is identical across the native-consumer SDKs (.NET/Java/Node) and the Transport+App SDKs (Python/Go).",
"cases": [
{ "name": "first-delivery", "body_attempts": 0, "redelivery_count": 0, "expected_attempts": 0 },
{ "name": "third-delivery", "body_attempts": 0, "redelivery_count": 2, "expected_attempts": 2 },
{ "name": "native-exceeds-body", "body_attempts": 2, "redelivery_count": 5, "expected_attempts": 5 },
{ "name": "never-lower-runtime", "body_attempts": 5, "redelivery_count": 1, "expected_attempts": 5 },
{ "name": "first-delivery-keeps-body", "body_attempts": 4, "redelivery_count": 0, "expected_attempts": 4 },
{ "name": "native-equals-body", "body_attempts": 3, "redelivery_count": 3, "expected_attempts": 3 }
]
},
"schema_version_gate": {
"description": "Consumer-side schema-version gate (broker-bindings.md §5.7). The consumer MUST read the Pulsar message property `bq-schema-version` BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate.",
"property": "bq-schema-version",
"fixture": "fixtures/order-created.json",
"cases": [
{ "value": "1", "expect": "decode" },
{ "value": "", "expect": "decode" },
{ "value": " \t", "expect": "decode" },
{ "value": " ", "expect": "decode" },
{ "value": "\n\u000b\f\r", "expect": "decode" },
{ "absent": true, "expect": "decode" },
{ "value": "2", "expect": "reject" },
{ "value": "01", "expect": "reject" },
{ "value": "x", "expect": "reject" },
{ "value": " 1", "expect": "reject" },
{ "value": "1 ", "expect": "reject" },
{ "value": "\t1\n", "expect": "reject" },
{ "value": "\u00a0", "expect": "reject" },
{ "value": "\u0085", "expect": "reject" },
{ "value": "\u3000", "expect": "reject" },
{ "value": "\ufeff", "expect": "reject" },
{ "value": "\u00a01", "expect": "reject" },
{ "value": "1\u3000", "expect": "reject" }
]
}
},
"kafka": {
"description": "Apache Kafka binding conformance (broker-bindings.md §6). Every SDK that ships a Kafka transport must satisfy these. The record value is the byte-identical envelope (the 'cases' above); these lock the bq- header projection + the bq-attempts-authoritative reconciliation the binding adds. Per-message values reuse fixtures/order-created.json so the expected projection is deterministic.",
"property_projection": {
"description": "On produce, the transport MUST project these native Kafka record headers from the envelope, all UTF-8 byte strings (Kafka headers are bytes, so integers are stringified): bq-job = job (the URN), bq-trace-id = trace_id, bq-message-id = meta.id, bq-schema-version = str(meta.schema_version), bq-source-lang = meta.lang, bq-attempts = str(attempts). The record value is the byte-identical envelope and the record timestamp mirrors meta.created_at (Unix ms). Applies to every Kafka-producing SDK.",
"envelope_file": "fixtures/order-created.json",
"headers": {
"bq-job": "urn:babel:orders:created",
"bq-trace-id": "7b3f9c2a-e41d-4f88-9b2a-1c0d5e6f7a8b",
"bq-message-id": "f1e2d3c4-b5a6-4789-90ab-cdef01234567",
"bq-schema-version": "1",
"bq-source-lang": "php",
"bq-attempts": "0"
}
},
"attempts_reconciliation": {
"description": "On consume, attempts = the bq-attempts header when present (AUTHORITATIVE — Kafka has no native delivery count), else the body's own attempts (the fallback for a non-BabelQueue producer). This is NOT a max: the header overrides the body even when lower. A null header_attempts means the header is absent. The rule is identical across all five Kafka SDKs.",
"cases": [
{ "name": "header-matches-body", "body_attempts": 0, "header_attempts": 0, "expected_attempts": 0 },
{ "name": "header-present", "body_attempts": 0, "header_attempts": 2, "expected_attempts": 2 },
{ "name": "header-absent-falls-back", "body_attempts": 3, "header_attempts": null, "expected_attempts": 3 },
{ "name": "header-authoritative-overrides", "body_attempts": 5, "header_attempts": 1, "expected_attempts": 1 },
{ "name": "header-higher-than-body", "body_attempts": 1, "header_attempts": 4, "expected_attempts": 4 }
]
},
"schema_version_gate": {
"description": "Consumer-side schema-version gate (broker-bindings.md §6.7). The consumer MUST read the Kafka record header `bq-schema-version` BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate. A JSON null 'value' stands for a present-but-null Kafka record header (Kafka allows a null header value): it is treated exactly like an absent one (the header carries no version) and decodes, so the runner MUST put the header key into the record with a null value rather than omit it, and an SDK MUST NOT stringify the null (a header whose value became the text \"null\" would be rejected).",
"property": "bq-schema-version",
"fixture": "fixtures/order-created.json",
"cases": [
{ "value": "1", "expect": "decode" },
{ "value": "", "expect": "decode" },
{ "value": " \t", "expect": "decode" },
{ "value": " ", "expect": "decode" },
{ "value": "\n\u000b\f\r", "expect": "decode" },
{ "absent": true, "expect": "decode" },
{ "value": "2", "expect": "reject" },
{ "value": "01", "expect": "reject" },
{ "value": "x", "expect": "reject" },
{ "value": " 1", "expect": "reject" },
{ "value": "1 ", "expect": "reject" },
{ "value": "\t1\n", "expect": "reject" },
{ "value": "\u00a0", "expect": "reject" },
{ "value": "\u0085", "expect": "reject" },
{ "value": "\u3000", "expect": "reject" },
{ "value": "\ufeff", "expect": "reject" },
{ "value": "\u00a01", "expect": "reject" },
{ "value": "1\u3000", "expect": "reject" },
{ "value": null, "expect": "decode" }
]
}
},
"artemis": {
"description": "Apache ActiveMQ Artemis binding conformance (broker-bindings.md §7). Every SDK that ships an Artemis transport must satisfy these. The message body stays byte-identical (the 'cases' above); these lock the AMQP-1.0 projection + reconciliation the binding adds. Per-message values reuse fixtures/order-created.json so the expected projection is deterministic.",
"property_projection": {
"description": "On produce, the transport MUST project the envelope onto the AMQP a JMS peer reads: the x-opt-jms-type message annotation = job (the URN, the AMQP-JMS mapping of JMSType), correlation-id = trace_id (JMSCorrelationID), creation-time = meta.created_at (JMSTimestamp, Unix ms), plus the bq_ application properties, all string-valued. The names use UNDERSCORES (bq_schema_version, not bq-schema-version): JMS property names must be valid Java identifiers (no hyphens), and the Java binding consumes/produces over JMS, so every Artemis SDK uses the JMS-legal underscore form for cross-protocol parity. bq_schema_version = str(meta.schema_version), bq_source_lang = meta.lang, bq_attempts = str(attempts), bq_app_id = 'babelqueue'. The body is the byte-identical envelope. Unlike Kafka/Pulsar, the URN / trace_id / message-id are NOT bq_ properties — they ride the JMS-native slots. Applies to every Artemis-producing SDK.",
"envelope_file": "fixtures/order-created.json",
"jms_type_annotation": "x-opt-jms-type",
"jms_type": "urn:babel:orders:created",
"correlation_id": "7b3f9c2a-e41d-4f88-9b2a-1c0d5e6f7a8b",
"properties": {
"bq_schema_version": "1",
"bq_source_lang": "php",
"bq_attempts": "0",
"bq_app_id": "babelqueue"
}
},
"attempts_reconciliation": {
"description": "On consume, attempts = max(body.attempts, delivery-count): the AMQP delivery-count header is 0-based (0 on first delivery) so it maps directly with NO -1, a runtime-incremented body count is never lowered, and delivery-count 0 leaves the body's own count untouched (the runtime/App retries by republishing with attempts+1, which resets the broker's delivery-count to 0). The Java JMS binding reads the 1-based JMSXDeliveryCount and subtracts 1, arriving at the same 0-based attempts. The rule is identical across the native-consumer SDKs (.NET/Java/Node) and the Transport+App SDKs (Python/Go).",
"cases": [
{ "name": "first-delivery", "body_attempts": 0, "delivery_count": 0, "expected_attempts": 0 },
{ "name": "third-delivery", "body_attempts": 0, "delivery_count": 2, "expected_attempts": 2 },
{ "name": "native-exceeds-body", "body_attempts": 2, "delivery_count": 5, "expected_attempts": 5 },
{ "name": "never-lower-runtime", "body_attempts": 5, "delivery_count": 1, "expected_attempts": 5 },
{ "name": "first-delivery-keeps-body", "body_attempts": 4, "delivery_count": 0, "expected_attempts": 4 },
{ "name": "native-equals-body", "body_attempts": 3, "delivery_count": 3, "expected_attempts": 3 }
]
},
"schema_version_gate": {
"description": "Consumer-side schema-version gate (broker-bindings.md §7.7). The consumer MUST read the Artemis application property `bq_schema_version` (underscores, ADR-0017) BEFORE decoding the body. Blank means the empty string or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) - the same set in every SDK (GR-5): an absent or blank value falls through to the normal decode path (the body meta.schema_version check still applies afterwards). Otherwise the value is compared as-is, never trimmed: exactly \"1\" decodes, and anything else is rejected WITHOUT decoding (poison/DLQ path) - including \"2\", \"01\", \"x\", values padded with whitespace (\" 1\", \"1 \"), and values made of non-ASCII whitespace (NBSP U+00A0, U+0085, U+3000) or a BOM (U+FEFF), which are NOT blank. A unicode-aware blank check or a trim() before comparing fails these cases. Each case supplies the property 'value' (or 'absent': true) and the 'expect'ed verdict; the message body is always the valid envelope in 'fixture', so a 'reject' verdict can only come from the property gate. A JSON null 'value' stands for a present-but-null application property: it is treated exactly like an absent one (the property carries no version) and decodes, so the runner MUST put the property key into the message with a null value rather than omit it. A reader whose message API cannot carry a null application property MUST skip this case explicitly (and assert that it skips) rather than silently drop it.",
"property": "bq_schema_version",
"fixture": "fixtures/order-created.json",
"cases": [
{ "value": "1", "expect": "decode" },
{ "value": "", "expect": "decode" },
{ "value": " \t", "expect": "decode" },
{ "value": " ", "expect": "decode" },
{ "value": "\n\u000b\f\r", "expect": "decode" },
{ "absent": true, "expect": "decode" },
{ "value": "2", "expect": "reject" },
{ "value": "01", "expect": "reject" },
{ "value": "x", "expect": "reject" },
{ "value": " 1", "expect": "reject" },
{ "value": "1 ", "expect": "reject" },
{ "value": "\t1\n", "expect": "reject" },
{ "value": "\u00a0", "expect": "reject" },
{ "value": "\u0085", "expect": "reject" },
{ "value": "\u3000", "expect": "reject" },
{ "value": "\ufeff", "expect": "reject" },
{ "value": "\u00a01", "expect": "reject" },
{ "value": "1\u3000", "expect": "reject" },
{ "value": null, "expect": "decode" }
]
}
},
"redis": {
"description": "Redis binding conformance (broker-bindings.md §1 — the reliable-queue list pattern). Redis lists carry no native metadata, so there is NO property projection: the queue element IS the canonical envelope JSON, byte-for-byte, with NO wrapping (unlike BullMQ's job structure) and NO added fields. The reserve/ack reliability (Laravel's reserved-sorted-set vs the App runtimes' processing-list) and attempts handling are SDK-runtime-specific and proven by the live interop round-trip, not a static fixture. The one cross-SDK invariant locked here is payload identity.",
"payload_identity": {
"description": "On produce, the transport MUST store the envelope JSON byte-for-byte as the queue element (RPUSH / equivalent); on reserve it MUST return that element unchanged — no wrapping, no envelope mutation, no added metadata. A §1 SDK round-trips fixtures/order-created.json through produce→reserve and gets back the identical bytes. Applies to every Redis-producing SDK.",
"envelope_file": "fixtures/order-created.json"
}
},
"rabbitmq": {
"description": "RabbitMQ binding conformance (broker-bindings.md §2 — AMQP 0-9-1). The envelope body stays byte-identical (the 'cases' above); this locks the native AMQP-0-9-1 property projection every producer emits. NOTE: consume-side attempts handling is NOT in scope here because it is runtime-specific — the Laravel driver reads the authoritative x-attempts header (§2.5), while the App-runtime SDKs (Go/Python) keep attempts in the body and republish with attempts+1 (the x-attempts header is then a redundant produce-side mirror). Both stay consistent because Laravel increments the body's attempts too. Per-message values reuse fixtures/order-created.json.",
"property_projection": {
"description": "On produce, the transport MUST project these native AMQP 0-9-1 properties + headers from the envelope. Header values are NATIVE-typed (AMQP 0-9-1 field-tables carry typed values — integers stay integers, NOT stringified like Kafka/Pulsar): type = job (the URN, route on it without reading the body), correlation_id = trace_id, message_id = meta.id, app_id = 'babelqueue', content_type = 'application/json', header x-schema-version = meta.schema_version (number), x-source-lang = meta.lang, x-attempts = attempts (number). The body is the byte-identical envelope. Applies to every RabbitMQ-producing SDK.",
"envelope_file": "fixtures/order-created.json",
"properties": {
"type": "urn:babel:orders:created",
"correlation_id": "7b3f9c2a-e41d-4f88-9b2a-1c0d5e6f7a8b",
"message_id": "f1e2d3c4-b5a6-4789-90ab-cdef01234567",
"app_id": "babelqueue",
"content_type": "application/json"
},
"headers": {
"x-schema-version": 1,
"x-source-lang": "php",
"x-attempts": 0
}
}
},
"payload_schema": {
"description": "Per-URN data schema validation (ADR-0024). Each case validates `data` against `schema`; every SDK's optional payload validator (Go schema, PHP BabelQueue\\Schema, Python babelqueue.schema) MUST agree on `valid`. The wire envelope stays frozen — this governs the data block only, and is opt-in (consumers/producers without a registered schema skip it).",
"schema": {
"$schema": "http://json-schema.org/draft-07/schema#",
"type": "object",
"required": ["order_id"],
"properties": {
"order_id": { "type": "integer", "minimum": 1 },
"amount": { "type": "number", "minimum": 0 },
"currency": { "enum": ["USD", "EUR", "TRY"] }
},
"additionalProperties": false
},
"cases": [
{ "name": "valid-minimal", "valid": true, "data": { "order_id": 1042 } },
{ "name": "valid-full", "valid": true, "data": { "order_id": 1042, "amount": 99.9, "currency": "USD" } },
{ "name": "invalid-missing-required", "valid": false, "data": { "amount": 10 } },
{ "name": "invalid-wrong-type", "valid": false, "data": { "order_id": "x" } },
{ "name": "invalid-additional-property", "valid": false, "data": { "order_id": 1, "extra": true } },
{ "name": "invalid-enum", "valid": false, "data": { "order_id": 1, "currency": "GBP" } },
{ "name": "invalid-below-minimum", "valid": false, "data": { "order_id": 0 } }
]
},
"roundtrip": {
"description": "Forward-compatible re-emit (message-envelope.md §4/§8: consumers MUST ignore unknown keys; GR-5). Each case is a decode -> attempts+1 -> encode chain, i.e. what every SDK does on retry/redrive/relay. Decode `file` with the SDK core (it MUST be accepted), increment `attempts` by one, re-encode, then parse the output JSON and assert: `attempts` == `expect_attempts`, and for every entry of `expect_preserved` the value at that RFC 6901 JSON pointer is deep-equal to the given value (same JSON type — an object is never an array). Unknown keys MUST NOT be dropped, renamed or retyped. Key order and whitespace are NOT asserted. `producer_schema_valid: false` marks a consumer-tolerance fixture that intentionally does not pass the producer JSON Schema (like urn-alias); the SDK MUST still accept and re-emit it. Optional `expect_absent_after_reencode` (conformance 1.4.0, ADR-0031): a list of RFC 6901 pointers, none of which may exist in the re-encoded output (evaluated on the same re-encoded document as `expect_preserved`); a case without the field behaves as before, and a runner that does not know the field ignores it. Optional `apply_dead_letter` (conformance 1.4.0): `{ \"reason\", \"original_queue\" }`. When present, after the attempts+1 step the runner moves the message to the dead-letter queue with the SDK's own DLQ helper (the one the worker uses on retry exhaustion; message-envelope.md section 10b, error-handling.md section 6), `reason` being one of `failed`, `unknown_urn`, `poison`, then parses the dead-letter copy instead of the plain re-encode; every assertion of the case (`expect_attempts`, `expect_preserved`, `expect_absent_after_reencode`) is evaluated on that copy. Fields the helper needs beyond these two (error message, exception type, timestamp) are runner-chosen and not asserted. Optional `expect_dead_letter` (a map of `dead_letter` sub-field to expected value) is evaluated only when `apply_dead_letter` was applied, on that copy: the `dead_letter` object MUST exist and each listed sub-field MUST deep-equal the value. A runner that does not know these fields ignores them and runs the case as a plain roundtrip. Every roundtrip case expects decode to emit no warning (no fixture here carries a forbidden key, and `urn` is the source of the identity, not a dropped key, when `job` is missing or blank).",
"cases": [
{
"name": "unknown-meta-roundtrip",
"file": "fixtures/unknown-meta-roundtrip.json",
"description": "Unknown meta keys (a scalar and a nested object) survive decode -> attempts+1 -> encode with the same values.",
"expect_attempts": 1,
"expect_preserved": {
"/meta/vendor_flag": true,
"/meta/vendor_ctx": {
"region": "eu-west-1",
"hops": [
1,
2
]
},
"/meta/lang": "php"
}
},
{
"name": "unknown-toplevel-roundtrip",
"file": "fixtures/unknown-toplevel-roundtrip.json",
"description": "An unknown top-level key survives decode -> attempts+1 -> encode with the same value.",
"expect_attempts": 2,
"expect_preserved": {
"/extra_top": 1
}
},
{
"name": "unknown-lang",
"file": "fixtures/unknown-lang.json",
"description": "A meta.lang outside the known language list (a future/community SDK) is decoded without error and re-emitted unchanged — a consumer MUST NOT reject or rewrite it.",
"producer_schema_valid": false,
"expect_attempts": 1,
"expect_preserved": {
"/meta/lang": "cobol"
}
},
{
"name": "empty-data-roundtrip",
"file": "fixtures/empty-data-roundtrip.json",
"description": "An empty-object data survives the round-trip as an object ({}), never as an array ([]).",
"expect_attempts": 1,
"expect_preserved": {
"/data": {}
}
},
{
"name": "wrong-case-keys-roundtrip",
"file": "fixtures/wrong-case-keys-roundtrip.json",
"description": "Envelope keys are matched case-sensitively, so a wrongly cased key ('JOB', 'Data', 'meta.Queue') is an unknown key: it never overrides the canonical field and survives decode -> attempts+1 -> encode with the same value.",
"expect_attempts": 1,
"expect_preserved": {
"/job": "urn:babel:orders:created",
"/data": { "order_id": 1042 },
"/meta/queue": "orders",
"/JOB": "urn:babel:orders:shadow",
"/Data": { "order_id": 7 },
"/meta/Queue": "shadow"
}
},
{
"name": "meta-ext-vendor-roundtrip",
"file": "fixtures/meta-ext-vendor-roundtrip.json",
"description": "A vendor extension block under meta.ext.<vendor> (ADR-0031 (d)) with nested objects and arrays, for two vendors, survives decode -> attempts+1 -> encode unchanged, key for key.",
"expect_attempts": 1,
"expect_preserved": {
"/job": "urn:acme:a",
"/meta/ext/acme": { "tier": "gold", "flags": [1, 2], "limits": { "burst": 10 } },
"/meta/ext/globex": { "region": "eu-west-1" },
"/meta/lang": "php"
}
},
{
"name": "dead-letter-roundtrip",
"file": "fixtures/dead-letter-roundtrip.json",
"description": "ADR-0031 / message-envelope.md section 8 rule 7: a DLQ move is a re-emit, so unknown keys survive it. The runner decodes `file`, increments `attempts` (the failed delivery), then moves the message to the dead-letter queue with the SDK's own DLQ helper using `apply_dead_letter` and parses the dead-letter copy. Unknown `meta.*` keys (`vendor_flag`, `ext.acme`), the top-level `extra_top` and the identity keys come back unchanged, and the `dead_letter` block carries the requested `reason` and `original_queue`. Other `dead_letter` fields (`error`, `exception`, `failed_at`, `attempts`, `lang`) are chosen by the SDK and not asserted. A runner that does not know `apply_dead_letter` runs this as a plain decode -> attempts+1 -> encode chain, which also passes.",
"apply_dead_letter": { "reason": "failed", "original_queue": "orders" },
"expect_attempts": 3,
"expect_preserved": {
"/job": "urn:acme:a",
"/trace_id": "7b3f9c2a-e41d-4f88-9b2a-1c0d5e6f7a8b",
"/meta/id": "f1e2d3c4-b5a6-4789-90ab-cdef01234567",
"/meta/queue": "orders",
"/meta/lang": "php",
"/meta/created_at": 1749132727000,
"/meta/schema_version": 1,
"/meta/vendor_flag": true,
"/meta/ext/acme": { "tier": "gold", "flags": [1, 2] },
"/extra_top": 1,
"/data": { "order_id": 1042 }
},
"expect_dead_letter": { "reason": "failed", "original_queue": "orders" }
},
{
"name": "urn-only-roundtrip",
"file": "fixtures/urn-only-roundtrip.json",
"description": "ADR-0031 (c): an envelope with `urn` and no `job` is accepted, the URN is read from `urn`, and the re-emit carries it as `job` with no `urn` key. No warning is expected (`urn` is the source of the identity). producer_schema_valid is false because the producer schema requires `job`.",
"producer_schema_valid": false,
"expect_attempts": 1,
"expect_preserved": {
"/job": "urn:acme:b"
},
"expect_absent_after_reencode": [
"/urn"
]
},
{
"name": "blank-ascii-job-urn-fallback",
"file": "fixtures/blank-ascii-job-urn-fallback.json",
"description": "ADR-0031 (c), user decision 2026-10-17: a `job` that is empty or only ASCII whitespace (space, \\t, \\n, \\v, \\f, \\r) counts as absent, so the URN falls back to `urn` and the re-emit writes it as `job` with no `urn` key. Fixture `job` is two spaces. No warning is expected. SDKs that do not yet implement ADR-0031 (c) fail this case until their SDK phase lands.",
"expect_attempts": 1,
"expect_preserved": {
"/job": "urn:acme:b"
},
"expect_absent_after_reencode": [
"/urn"
]
}
]
},
"data_shape": {
"description": "The `data` block is always a JSON object (message-envelope.md §3, GR-3). `mode: encode` cases build a new envelope with the SDK's producer API from `urn` + `queue` + `data`, then assert the raw JSON text of the emitted `data` value, with insignificant whitespace removed, equals `expect_encoded_data_json` (an empty map MUST encode as {} — never []). `mode: decode` cases decode `file` and assert the SDK's verdict equals `valid` (`valid: false` = the core rejects it: accepts()/decode fails).",
"cases": [
{
"name": "empty-data",
"mode": "encode",
"urn": "urn:babel:orders:created",
"queue": "orders",
"data": {},
"expect_encoded_data_json": "{}"
},
{
"name": "data-array-rejected",
"mode": "decode",
"file": "fixtures/data-array-rejected.json",
"valid": false,
"reason": "data is a JSON array, not an object"
}
]
},
"forbidden_keys": {
"description": "Non-canonical keys (message-envelope.md §10). Policy K-15 for R0: decode WARNS, it does not reject (old producers keep working); encode NEVER emits them. For each case: decode `file` — it MUST succeed (`expect: warn`) AND the SDK MUST surface at least one warning (via its logger / warning hook) naming `forbidden_key`. The forbidden key MUST NOT be captured into the unknown-key extras, so re-encoding the decoded message (no other change) MUST NOT contain any pointer in `expect_absent_after_reencode`. All other fields round-trip as usual. Policy update (ADR-0031 (c), conformance 1.4.0): the decode warning is a MUST, and encode of a forbidden key is rejected (see `encode_reject`); decode stays lenient. Optional `expect_preserved` (1.4.0): an object {\"<RFC 6901 pointer>\": <value>}; every pointer MUST hold the given value (same JSON type) in the re-encoded document, evaluated at the same moment as `expect_absent_after_reencode`. A case without the field behaves as before, and a runner that does not know the field ignores it. The two `urn` cases below fix the `job`+`urn` rules: `job` wins and `urn` is dropped with a warning naming the `/urn` pointer in the same form the SDK's existing forbidden-key warnings use; `job` is blank only for the closed ASCII whitespace set, so a `job` of U+2003 is NOT blank and does NOT fall back to `urn`. These two fixtures are not `accepts()`-negative: `accepts()` does not check URN syntax, so it stays true (Go's runner does not assert it). SDKs that do not yet implement ADR-0031 (c) fail these cases until their SDK phase lands; the cases are never skipped.",
"cases": [
{
"name": "forbidden-key-timestamp",
"file": "fixtures/forbidden-key-timestamp.json",
"forbidden_key": "/timestamp",
"expect": "warn",
"expect_absent_after_reencode": [
"/timestamp"
]
},
{
"name": "forbidden-key-meta-max-retries",
"file": "fixtures/forbidden-key-meta-max-retries.json",
"forbidden_key": "/meta/max_retries",
"expect": "warn",
"expect_absent_after_reencode": [
"/meta/max_retries"
]
},
{
"name": "forbidden-key-meta-attempts",
"file": "fixtures/forbidden-key-meta-attempts.json",
"forbidden_key": "/meta/attempts",
"expect": "warn",
"expect_absent_after_reencode": [
"/meta/attempts"
]
},
{
"name": "forbidden-key-meta-source",
"file": "fixtures/forbidden-key-meta-source.json",
"forbidden_key": "/meta/source",
"expect": "warn",
"expect_absent_after_reencode": [
"/meta/source"
]
},
{
"name": "forbidden-key-meta-ts",
"file": "fixtures/forbidden-key-meta-ts.json",
"forbidden_key": "/meta/ts",
"expect": "warn",
"expect_absent_after_reencode": [
"/meta/ts"
]
},
{
"name": "forbidden-key-job-and-urn",
"file": "fixtures/forbidden-key-job-and-urn.json",
"description": "ADR-0031 (c): `job` and `urn` both present. `job` wins, `urn` is dropped from the decoded message with a warning naming /urn, and the re-emit has /job unchanged and no /urn.",
"forbidden_key": "/urn",
"expect": "warn",
"expect_absent_after_reencode": [
"/urn"
],
"expect_preserved": {
"/job": "urn:acme:a"
}
},
{
"name": "forbidden-key-job-nonascii-space-and-urn",
"file": "fixtures/forbidden-key-job-nonascii-space-and-urn.json",
"description": "ADR-0031 (c), negative: `job` is only U+2003 (EM SPACE), which is outside the closed ASCII blank set, so `job` is not blank: it wins, `urn` is dropped with a warning naming /urn, and there is NO fallback to `urn`. Re-emit keeps /job as U+2003 and has no /urn.",
"forbidden_key": "/urn",
"expect": "warn",
"expect_absent_after_reencode": [
"/urn"
],
"expect_preserved": {
"/job": "\u2003"
}
}
]
},
"extension_write": {
"description": "Producer `meta` write API (ADR-0031 (b); Go WithMeta, Python make(meta=), Node MakeOptions.meta, PHP make(meta:), Java make(urn, data, queue, traceId, Map meta), .NET Make(meta:)). For each case call the SDK's producer API with `urn`, `queue`, `data` and the `meta` entries (one flat meta key per entry; a vendor block is supplied as the whole `ext` value), then run two checks. (1) Encode the message, parse the output JSON and assert every `expect_envelope` pointer (RFC 6901) equals the given value, with JSON type distinction ({} != [], true != 1); the entries sit next to the core meta keys, which stay as the SDK generated them. (2) Re-emit chain: decode that output, increment `attempts` by one, re-encode, parse, and assert every `expect_envelope` pointer again (so extension keys survive a retry/redrive hop) and that /attempts == 1. Per-message fields (meta.id, trace_id, meta.created_at) are not asserted by value. Key order and whitespace are not asserted. A runner that does not know this block skips it.",
"cases": [
{
"name": "flat-scalar-key",
"description": "A single flat extension key with a boolean value lands in meta next to the core keys.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "vendor_flag": true },
"expect_envelope": {
"/job": "urn:acme:orders:created",
"/data": { "order_id": 1042 },
"/meta/queue": "orders",
"/meta/schema_version": 1,
"/meta/vendor_flag": true
}
},
{
"name": "vendor-block-under-ext",
"description": "The recommended shape (ADR-0031 (d)): a vendor block under meta.ext.<vendor>, with nested objects and arrays, supplied as the whole `ext` value.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "ext": { "acme": { "tier": "gold", "flags": [1, 2], "limits": { "burst": 10 } } } },
"expect_envelope": {
"/meta/ext/acme": { "tier": "gold", "flags": [1, 2], "limits": { "burst": 10 } },
"/meta/queue": "orders"
}
},
{
"name": "two-vendors-in-one-ext",
"description": "Two vendor blocks supplied together in one `ext` value both survive; neither overwrites the other.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "ext": { "acme": { "tier": "gold" }, "globex": { "region": "eu-west-1" } } },
"expect_envelope": {
"/meta/ext/acme": { "tier": "gold" },
"/meta/ext/globex": { "region": "eu-west-1" }
}
},
{
"name": "several-flat-keys-mixed-types",
"description": "Several flat keys of different JSON types (string, integer, array, empty object) keep name, value and type.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "vendor_region": "eu-west-1", "vendor_count": 3, "vendor_tags": ["a", "b"], "vendor_ctx": {} },
"expect_envelope": {
"/meta/vendor_region": "eu-west-1",
"/meta/vendor_count": 3,
"/meta/vendor_tags": ["a", "b"],
"/meta/vendor_ctx": {}
}
},
{
"name": "non-ascii-value",
"description": "A non-ASCII string value in an extension key is value-equal after parse (UTF-8; a runner compares the parsed value, so `\\uXXXX` escaping of the output is accepted).",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "ext": { "acme": { "note": "ğüşiöç \u00e9 \ud83d\ude00" } } },
"expect_envelope": {
"/meta/ext/acme/note": "ğüşiöç \u00e9 \ud83d\ude00"
}
}
]
},
"encode_reject": {
"description": "Encode MUST reject (ADR-0031 (b), (c)): an `error` in Go, an exception in every other language; never a silent drop and never a mere warning. Every case has `expect: \"reject\"`. Build the message from `urn`, `queue`, `data` and the optional input fields below, then call the producer/encode path; the call MUST fail, and no envelope JSON may be produced. Input fields: `meta` = entries passed through the producer `meta` write API (object, keys unique); `meta_entries` = the same entries as an ordered list of [key, value] pairs, for a REPEATED key, which a JSON object cannot express (SDKs whose write API takes one map per call, i.e. every SDK except Go, cannot express a repeat and skip those cases); `extras_top` and `extras_meta` = entries the runner places directly into the message's preserved unknown-key container at top level or under meta, by whatever test access the SDK has (in-package access, a constructor taking extras, reflection), standing for extras carried over from an inbound message; this is how top-level `timestamp`/`urn` are exercised, since the write API offers no top-level keys. `offending_key` names the key (RFC 6901 pointer) and is informational: a runner MAY assert that the error message mentions it, it is not required. Core meta keys (id, queue, lang, schema_version, created_at) and the forbidden keys of message-envelope.md §10 are the rejected sets. A runner that does not know this block skips it.",
"cases": [
{
"name": "reject-top-level-timestamp",
"description": "Forbidden top-level `timestamp` arriving through preserved top-level extras.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"extras_top": { "timestamp": 1749132727 },
"offending_key": "/timestamp",
"expect": "reject"
},
{
"name": "reject-top-level-urn",
"description": "Forbidden top-level `urn` arriving through preserved top-level extras; the message carries `job` already, so `urn` can only be a leftover alias.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"extras_top": { "urn": "urn:acme:orders:created" },
"offending_key": "/urn",
"expect": "reject"
},
{
"name": "reject-meta-max-retries",
"description": "Forbidden meta.max_retries passed to the meta write API.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "max_retries": 3 },
"offending_key": "/meta/max_retries",
"expect": "reject"
},
{
"name": "reject-meta-attempts",
"description": "Forbidden meta.attempts (a draft shadow of top-level `attempts`) passed to the meta write API.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "attempts": 1 },
"offending_key": "/meta/attempts",
"expect": "reject"
},
{
"name": "reject-meta-source",
"description": "Forbidden meta.source passed to the meta write API.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "source": "billing" },
"offending_key": "/meta/source",
"expect": "reject"
},
{
"name": "reject-meta-ts",
"description": "Forbidden meta.ts passed to the meta write API.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "ts": 1749132727 },
"offending_key": "/meta/ts",
"expect": "reject"
},
{
"name": "reject-forbidden-meta-key-in-extras",
"description": "A forbidden meta key arriving through preserved meta extras (not the write API) is rejected too: encode applies to the message being encoded, whatever its origin.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"extras_meta": { "max_retries": 3 },
"offending_key": "/meta/max_retries",
"expect": "reject"
},
{
"name": "reject-core-meta-id",
"description": "Collision with core meta key `id`: the core never silently overwrites a core key.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "id": "00000000-0000-4000-8000-000000000000" },
"offending_key": "/meta/id",
"expect": "reject"
},
{
"name": "reject-core-meta-queue",
"description": "Collision with core meta key `queue`.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "queue": "shadow" },
"offending_key": "/meta/queue",
"expect": "reject"
},
{
"name": "reject-core-meta-lang",
"description": "Collision with core meta key `lang`.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "lang": "cobol" },
"offending_key": "/meta/lang",
"expect": "reject"
},
{
"name": "reject-core-meta-schema-version",
"description": "Collision with core meta key `schema_version`.",
"urn": "urn:acme:orders:created",
"queue": "orders",
"data": { "order_id": 1042 },
"meta": { "schema_version": 2 },
"offending_key": "/meta/schema_version",
"expect": "reject"
},
{
"name": "reject-core-meta-created-at",
"description": "Collision with core meta key `created_at`.",
"urn": "urn:acme:orders:created",