[caiwl]

Supersedes #50 and #53 by updating otlptrace and otlptracegrpc together, keeping the exporter and its transport on the same release.

Validation:

• dependencies resolved through the configured public Go proxy and checksum database
• go vet -composites=false ./pkg/... ./cmd/... ./api/...
• all three shipped binaries built successfully
• etcd store, Mongo store, evaluator, and evaluator-function tests passed

[github-actions]

## Ark ReviewBot review

**Verdict:** Comment only

### Findings

#### [P2] Major-version swap of indirect dependency cenkalti/backoff v4 → v5
`go.mod:32`

`github.com/cenkalti/backoff/v4 v4.3.0` is replaced by `github.com/cenkalti/backoff/v5 v5.0.3` (indirect). This is a major-version module path change, almost certainly pulled in by the bumped `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` v1.34.0 → v1.45.0. backoff v5 changed its public API (e.g., retry/notification signatures, generics-based `Retry`); any Speedle+ code or remaining dependency still importing `/v4` would silently keep two backoff implementations, and the OTLP trace exporter's retry/backoff behavior on transient collector failures changes without any test or config review in this diff. Impact: altered retry timing/exhaustion behavior on telemetry export paths, and possible dual-version bloat. Smallest safe correction: run `go mod why -m github.com/cenkalti/backoff/v5` and `grep -R "backoff/v4" --include=*.go` to confirm nothing in-tree imports v4, and pin/verify the exporter's retry configuration behavior under v5.

#### [P3] Unverifiable future-dated pseudo-versions for genproto
`go.mod:117-118`

`google.golang.org/genproto/googleapis/api` and `.../rpc` jump from pseudo-version `v0.0.0-20260526163538-...` to `v0.0.0-20260803160001-...`. These timestamps are far-future relative to typical release cadence and cannot be validated against upstream from the supplied material. If provenance tooling (or a poisoned proxy/GONOSUMDB path) injected these, the module hashes in `go.sum` would still match whatever was fetched, so the diff alone cannot establish legitimacy. Impact: supply-chain risk on a module in the gRPC/authorization request path. Smallest safe correction: confirm the commit `6ac0973c030d` exists in the official googleapis/go-genproto repo and was resolved via proxy.golang.org with sumdb verification (`GONOSUMCHECK` off), before merging.

### What looks good
- `go.sum` entries were updated in lockstep with every changed `go.mod` line (old hashes removed, new hashes added for backoff/v5, grpc-gateway/v2, otlptrace, proto/otlp, genproto).
- Direct dependencies (etcd 3.5.18, grpc 1.83.2, k8s 0.31.0, mongo-driver) are untouched; the bump surface is limited to indirect modules.
- grpc-gateway/v2 and otlp bumps are ordinary minor/patch upgrades with matching sum lines.

### Validation gaps
- Static review cannot confirm the build compiles with backoff/v5 and otlptracegrpc v1.45.0, or that no in-tree code imports the removed `/v4` path.
- Cannot verify the genproto pseudo-version timestamps/hashes against the upstream repository or the Go checksum database from the supplied material.
- No tests accompany the dependency changes; runtime behavior of the OTLP exporter retry path under the new backoff major version is unverified.

<!-- reviewbot-verdict:actionable-findings -->
— **Ark ReviewBot**

Reviewed commit: 943569d939692a99c119ea6424240a39793df953

[caiwl]

Maintainer verification of both Ark findings:

• go mod why -m github.com/cenkalti/backoff/v5 shows v5 is used only through embedded etcd → OTLP gRPC exporter retry internals.
• go mod why -m github.com/cenkalti/backoff/v4 confirms v4 is no longer needed.
• No Speedle+ Go source imports either backoff major directly.
• All shipped binaries, vet, etcd/Mongo store tests, and evaluator tests passed.
• Both genproto modules resolved with GOPROXY=https://proxy.golang.org, GOSUMDB=sum.golang.org, and empty GONOSUMDB; Go reported official origin https://github.com/googleapis/go-genproto at commit 6ac0973c030de548f6a485902facf1e906a58fbf, with verified module sums.

These checks resolve the retry-dependency and provenance validation gaps.