[rennf93]

make test (the compose test service, pytest -v --cov=.) gave 27 failed on Python 3.10 and 29 on 3.14 on master. It gives 0 failed here. The compose example service and examples/advanced_app now start.

1. uv.lock is gitignored in this repo (git ls-files uv.lock prints nothing), but the Dockerfile ran uv sync --extra dev --frozen and compose.yml bind-mounted ./uv.lock. On a clean clone the build failed with Unable to find lockfile and, once the file was missing, Docker created a directory called uv.lock on the host and the mount failed with not a directory. I copied the guard-core pattern: uv sync --extra dev without --frozen and no uv.lock mount.
2. The engine's SecurityConfig defaults to enable_redis=True and redis_url=redis://localhost:6379. Tests that build a config without a redis_url therefore connect to localhost:6379 inside the test container, where no Redis listens, and the middleware answers 503. Tests that hardcoded the URL now read REDIS_URL the way the conftest does, and a session fixture in tests/conftest.py points the engine default at REDIS_URL when it is set (it does nothing when REDIS_URL is unset, so the CI service container on localhost still works). Files: tests/test_decorators/test_extension_integration.py, tests/conftest.py.
3. compose.yml started the example with gunicorn examples.main:app, a module that does not exist. It is gunicorn examples.simple_app.main:app now.
4. examples/advanced_app died at boot with ValueError: return_pattern rule with pattern '404' requires reading the response body, but behavior_scan_response_body is False. The example config uses a body pattern, so app/security.py now sets behavior_scan_response_body=True, the same setting examples/simple_app/main.py has. The library is untouched.
5. Python 3.14 only: test_honeypot_form_detection and test_honeypot_json_detection built the request as a MagicMock. The engine checks the request against a runtime-checkable protocol (_BoundedBodyReader), which on 3.12 and later looks attributes up statically and does not see lazily created mock attributes, so the validator returned None. The tests now assign read_body_prefix as a real attribute.

Verification, the compose test service run as the Makefile runs it, own compose project, Redis without a host port, master vs this branch:

• Python 3.10: master 212 passed, 27 failed; branch 239 passed, 0 failed.
• Python 3.14: master 210 passed, 29 failed; branch 239 passed, 0 failed.
• Master runs used a locally generated uv.lock, because master does not build without one.
• The example service from compose.yml: healthy, GET / 200, uid=10001.
• examples/advanced_app with nginx on a high host port, the real app: app healthy through the Dockerfile HEALTHCHECK, nginx GET /health 200, uid=10001.
• hadolint 2.15.1 on the Dockerfile: no output.

Not verified: Python versions other than 3.10 and 3.14, and the CI result (see the checks on this PR).