# Support and compatibility

| Contract | Current development support |
|---|---|
| Go | Exactly 1.26.5 for development and release verification |
| Spice minimum/current | Exact versions in [`spice-compatibility.json`](https://github.com/spice-framework/starter-grpc/blob/00b729eb791eddabff1aed6b9fdd51178814a165/spice-compatibility.json) |
| Spice starter API | Exact `v1alpha1`; mismatches fail closed |
| grpc-go | `google.golang.org/grpc` v1.82.1 |
| Operating systems | Windows, Linux, and macOS |
| Architectures | amd64 and arm64 compilation through the public core API |
| Transport | TLS 1.2+ by default; explicit plaintext only for isolated local development |
| Service model | Caller-owned generated registrations, listeners, clients, contexts, and cleanup |
| Release signer | `github.com/spice-framework/development/cmd/spice-dev` at `v0.0.0-20260806132124-4c308d1b9fda` |
| Independent verifier | `github.com/spice-framework/toolchain/cmd/spice-library-release-verify` at `v0.0.0-20260806133530-71211498297c` |
| Public trust anchor | [`security/release/ed25519-public.pem`](https://github.com/spice-framework/starter-grpc/blob/00b729eb791eddabff1aed6b9fdd51178814a165/security/release/ed25519-public.pem), SHA-256 `4bc50198c65b1e4f542d16cda46ca0736c716bebff63ececce1ea53daf285621` |

[`spice-compatibility.json`](https://github.com/spice-framework/starter-grpc/blob/00b729eb791eddabff1aed6b9fdd51178814a165/spice-compatibility.json) is the sole preview
compatibility boundary. The committed module selects its provisional minimum;
the current value is a forward-compatibility endpoint, not an unbounded runtime
dependency. The repository-owned compatibility verifier resolves each boundary
through an isolated alternate modfile, requires exact MVS selection, runs vet
and shuffled race tests for every product package with `GOPROXY=off`, and hashes
the repository before and after to prove source, module, and vendor immutability.

Release artifacts are produced only from an exact tagged commit under the
contract in [`releasing.md`](/integrations/grpc/releasing/). A compromised or missing signing
secret fails a production release; it never falls back to unsigned output.

The pinned central signer and independent verifier power the protected reusable
production workflow. Windows and Linux CI render the same inert central plan
twice under vendor-only offline resolution and require byte-identical unsigned
artifacts. The reviewed public trust anchor is configured at
`security/release/ed25519-public.pem`; its fingerprint is the SHA-256 digest of
the DER SubjectPublicKeyInfo bytes. The matching private key is stored only as
the repository Actions secret `SPICE_LIBRARY_RELEASE_SIGNING_KEY` and passed
through the exact one-name caller mapping. The protected `release-signing`
environment remains the human approval gate and contains no key. These
configured controls do not establish that a tag or published release exists.