Dependency review: franz-go

• Decision: approved for the standalone github.com/spice-framework/starter-kafka module.
• Version: github.com/twmb/franz-go v1.21.0.
• Upstream: https://github.com/twmb/franz-go.
• License: BSD-3-Clause; retained in the vendored module license.
• Maintenance: the active v1 line is pure Go and documents Kafka-compatible broker support through Kafka 4.2+, consumer groups, idempotent and transactional producers, administration, and current protocol KIPs.
• Security: verified TLS 1.2 or newer and authentication are independent defaults. Plaintext and unauthenticated local development each require an explicit opt-out. Broker addresses are exact bounded host:port values; credentials and payloads never enter starter-produced errors or interaction metadata. PLAIN and SCRAM mechanisms are explicit.
• Cancellation: ping, synchronous publish, and shutdown flush use caller-owned contexts. Spice sets finite dial and request-overhead defaults and bounds every configured timeout.
• Observability: franz-go has neutral hooks. Spice exposes payload-free synchronous publication and consumer-delivery observations and leaves broader OpenTelemetry hook installation caller-owned.
• Configuration: Open performs no network I/O, fixes all-ISR acknowledgement, retains franz-go’s idempotent producer, disables linger for synchronous behavior, bounds batches, and returns exact lifecycle cleanup.
• Integration: unit tests use narrow client seams to prove records, cancellation, observation, flush, idempotent close, bounded group polling, and acknowledge/retry/reject commit behavior. A pinned Redpanda real-broker workflow proves SCRAM authentication, publish/consume ordering, commits, restart behavior, and cleanup. Target production broker/TLS configurations still require their own acceptance.

Primary references:

• https://github.com/twmb/franz-go/releases/tag/v1.21.0
• https://github.com/twmb/franz-go#features
• https://github.com/twmb/franz-go/blob/master/docs/producing-and-consuming.md
• https://github.com/twmb/franz-go/blob/master/LICENSE

Build-only dependencies: Spice release tools

• Decision: approved as the repository-authorized release signer, renderer, and independent verifier.
• Signer version: github.com/spice-framework/development v0.0.0-20260806132124-4c308d1b9fda.
• Signer tool: github.com/spice-framework/development/cmd/spice-dev through the standard Go tool directive; invocations always use the full package path.
• Verifier version: github.com/spice-framework/toolchain v0.0.0-20260806133530-71211498297c.
• Verifier tool: github.com/spice-framework/toolchain/cmd/spice-library-release-verify.
• License: Apache-2.0, with its notice retained in vendor.
• Runtime scope: none. Product packages do not import the development module, and released applications acquire no runtime dependency on it.
• Dependency graph: the tool participates in normal Go minimal-version selection. That build-time coupling is accepted and visible in go.mod, go.sum, and vendor/modules.txt; no parallel tool registry is introduced.
• Integrity and network behavior: the exact pseudo-version is pinned and checksummed. Release rehearsal runs with GOWORK=off, GOPROXY=off, GOTOOLCHAIN=local, and GOFLAGS=-mod=vendor, so it cannot select an ambient checkout, upgrade itself, or download dependencies.
• Security: the trusted native renderer reads the exact committed Git graph and writes only to caller-supplied temporary output directories. The independent verifier authenticates release artifacts against an external trust anchor and exact Git objects. Neither tool generates private material.
• Maintenance: the protected central workflow is the sole production builder. The caller maps only the repository SPICE_LIBRARY_RELEASE_SIGNING_KEY secret; secret inheritance and additional mappings are rejected by repository verification. The protected signing and publishing environments remain approval boundaries. The former repository-local builder was removed after the protected, independently verified central path was established.