Add supported versions policy doc (4.0+)

- Document major support window, security fix line, and go-live scope
- Link from README; wiki remains source for the release matrix

Made-with: Cursor

Author: bart-vmware

README.md

@@ -36,7 +36,7 @@ In addition to the [feature documentation](https://steeltoe.io/api), we have bui
 | 3.x (Integration, Messaging and Stream) | .NET Core 3.1 - .NET 6 |
 | 2.x | .NET Framework 4.6.1+ |
 
-For more details, see [Supported Versions on the Wiki](https://github.com/SteeltoeOSS/Steeltoe/wiki/Steeltoe-Support-Versions).
+For the support policy, see [Supported versions](docs/Steeltoe-Support-Versions.md). For the full page with the release support matrix, see [Supported versions on the Wiki](https://github.com/SteeltoeOSS/Steeltoe/wiki/Steeltoe-Support-Versions).
 
 ## Support and Feedback
 

docs/Steeltoe-Support-Versions.md

@@ -0,0 +1,36 @@
+# Steeltoe supported versions
+
+The [release support matrix](https://github.com/SteeltoeOSS/Steeltoe/wiki/Steeltoe-Support-Versions#release-support-matrix) (dates, .NET runtimes) is on the project wiki. This page explains the support **policy** in the repository so it can be reviewed with pull requests.
+
+## Policy for Steeltoe 4.0 and newer
+
+**Scope.** The rules in this section apply to **Steeltoe 4.0 and later**. They do not change the dates already published for **3.x and older** in the wiki table. For those older lines, use the table as written.
+
+**Support policy**
+
+Steeltoe is *informed by* the VMware Tanzu open source support policy. The rules in this section are the Steeltoe project rules. They apply to **Steeltoe 4.0 and newer**.
+
+- **How long is a major supported?** A **major** is supported for **at least three years** from the **date that major was released**. It is also supported for **at least one year** after the **date the next major is released**. Support ends on the **later** of these two dates.
+- **Where do fixes go?** **Security** fixes and fixes for **serious** bugs are provided only in **new patch** releases of the **newest** **minor** in a supported **major** (for example, only 4.2.x if 4.2 is the newest minor, not 4.0.x or 4.1.x). You need the **latest patch** of that **newest** minor. We do **not** add new **security** patches to **older** minors. **Upgrade** to the newest **minor** and the **latest patch** to get those fixes.
+
+**Go-live releases**
+
+Go-live releases are supported by the Steeltoe team in production. These are typically our release candidate builds, just before the generally available (GA) release.
+
+Pre-GA and go-live packages are not in scope for the same security patch policy unless explicitly announced.
+
+**Released versions**
+
+For **4.0 and newer**, use the **newest** **minor** in your **major** and the **latest patch** to get **security** fixes (see **Support policy** above). The wiki table is unchanged for older versions: follow the **Scope** note above.
+
+**Matrix note (4.0+)**
+
+End of support for a **major** is no **earlier** than: (1) **three years** after that major’s first release, or (2) **one year** after the next major releases—**whichever date is later**. The dates in the wiki table for **3.x and older** are not changed by this policy.
+
+**Release compatibility**
+
+**Security** fixes and fixes for **serious** bugs do not go to every **minor** in a **major** at the same time. For **4.0 and newer**, use the **newest** **minor** and the **latest patch** (see **Support policy** above). Moving up between **minors** should still be in line with our **compatibility** goals within a **major** (see the [Release compatibility](https://github.com/SteeltoeOSS/Steeltoe/wiki/Steeltoe-Support-Versions#release-compatibility) section on the wiki).
+
+### .NET runtime support
+
+Steeltoe depends on .NET runtimes. Follow the [.NET and .NET Core support policy](https://dotnet.microsoft.com/platform/support/policy). More detail is in the **.NET Runtime Support** section on the [wiki page](https://github.com/SteeltoeOSS/Steeltoe/wiki/Steeltoe-Support-Versions#net-runtime-support).