# Support policy

| Contract | Current development support |
|---|---|
| Go | Exactly 1.26.5 for development and release verification |
| Spice minimum/current | Exact versions in [`spice-compatibility.json`](https://github.com/spice-framework/starter-otel/blob/fcb1b6e592dc65bb089c5cb32aa2a789c190233f/spice-compatibility.json) |
| OpenTelemetry Go | API and SDK v1.44.0 |
| Operating systems | Windows, Linux, and macOS |
| Architectures | amd64 and arm64 compilation through public Go APIs |
| Exporters | Application-owned; none bundled |
| Central release tools | `github.com/spice-framework/development/cmd/spice-dev` at `v0.0.0-20260806132124-4c308d1b9fda`; `github.com/spice-framework/toolchain/cmd/spice-library-release-verify` at `v0.0.0-20260806133530-71211498297c` |

`spice-compatibility.json` is the sole compatibility boundary source. Its
minimum must equal the exact direct Spice requirement in `go.mod`; its current
value is a forward-compatibility endpoint rather than a moving branch. The
repository gate verifies both boundaries using isolated alternate modfiles,
exact MVS selection, vet, and shuffled race tests without modifying product or
module files. A release may raise the minimum only through an intentional
module and compatibility-contract change with green minimum/current evidence.

Traces and metrics are supported. The OpenTelemetry logs API and all exporters
are deliberately outside this starter until they receive independent API,
dependency, maintenance, cancellation, security, and operability review.

Release artifacts are produced only from an exact tagged commit under the
contract in [`releasing.md`](/integrations/opentelemetry/releasing/). A compromised or missing signing
secret fails a production release; it never falls back to unsigned output.

The pinned central signer and independent verifier power the protected reusable
production workflow. The reviewed repository-specific trust anchor is
`security/release/ed25519-public.pem` (SHA-256 fingerprint
`9cddc67e1d2a0e30ba9157364929ea9ca8529ba05b0dce9e009526d0491ed9bf`).
Its private key exists only as repository Actions secret
`SPICE_LIBRARY_RELEASE_SIGNING_KEY`, and the caller explicitly maps only that
secret to the protected reusable workflow. Windows and Linux CI render the same
inert central plan twice under vendor-only offline resolution and require
byte-identical unsigned artifacts.