distribution: admit the blueline kernel packages

distribution/README.md

@@ -22,7 +22,9 @@ its release lands. Those decisions live here, once.
 - `../tools/validate-distribution.py` checks graph integrity and can verify a
   producer's complete emitted package/architecture set without requiring a
   device or a signing secret. A producer must fail rather than publish a
-  package absent from this graph.
+  package absent from this graph. A producer split into explicit jobs validates
+  each job's emitted subset; `--complete` is reserved for a producer whose one
+  job emits its whole declared set.
 - `.gitea/workflows/distribution.yml` makes that check a gate in the OS repo.
 
 The manifest is deliberately honest about maturity. A profile marked `blocked`

distribution/manifest.toml

@@ -38,7 +38,8 @@ souveraine = { producer = "souveraine", architectures = ["x86_64", "aarch64"], s
 upower-souveraine = { producer = "souveraine", architectures = ["x86_64", "aarch64"], state = "managed" }
 souveraine-updater = { producer = "souveraine-updater", architectures = ["x86_64", "aarch64"], state = "managed" }
 souveraine-viewtop = { producer = "souveraine-viewtop", architectures = ["aarch64", "x86_64"], state = "managed" }
-linux-blueline = { producer = "pixel3arch", architectures = ["aarch64"], state = "blocked", blocker = "kernel.yml does not publish into the shared archive" }
+linux-blueline = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+linux-blueline-headers = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
 souveraine-callaudio = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
 souveraine-callaudiod = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
 souveraine-ucm-blueline = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }

docs/tasks/25-one-repo-all-packages.md

@@ -1,16 +1,10 @@
 # TASK 25 — One gitea repo for every SouveraineOS package
 
-**Status:** 2026-07-30 — **Pixel3Arch now publishes every device package.**
+**Status:** 2026-08-13 — Pixel3Arch now has one package workflow. Its device
-`packages.yml` builds + signs all of them into the additive `edge` release,
+and kernel jobs publish signed artifacts into the additive `edge` release and
-so `pacman -Sl souveraine-aarch64` is the complete live manifest: 14 packages
+validate every emitted artifact against the central distribution contract. The
-(souveraine, -callaudio, -q6voiced, -ucm-blueline, -updater, upower-souveraine,
+former raw `kernel-latest` release path is retired; its first shared-archive CI
-pulse-native-provider, souveraine-osk-switch, hexagonrpc-blueline,
+proof remains required before calling the kernel delivery complete.
-tqftpserv-blueline, blueline-edge-sense, souveraine-stevia,
-souveraine-squeekboard, usb-signaller). Two deferred on purpose: `hyprgrass`
-(Hyprland plugin, phased out for viewtop) and `libssc-souveraine` (phone runs
-upstream libssc; our fork isn't deployed). **Goal achieved:** push → `pacman
--Syu` on the phone, no hand-carried packages. The kernel (`kernel.yml`) is the
-last holdout — it still ships a raw `.pkg.tar.zst` with no `repo-add --sign`.
 
 ## The problem in one line
 

tools/validate-distribution.py

@@ -19,6 +19,11 @@ def main() -> int:
     parser.add_argument("manifest", type=Path)
     parser.add_argument("--ready", metavar="PROFILE", help="require one profile to be installer-ready")
     parser.add_argument("--producer", metavar="NAME", help="validate artifacts emitted by one producer")
+    parser.add_argument(
+        "--complete",
+        action="store_true",
+        help="require --artifact to cover every managed artifact declared for --producer",
+    )
     parser.add_argument(
         "--artifact",
         metavar="PACKAGE:ARCHITECTURE",
@@ -132,7 +137,7 @@ def main() -> int:
             and package.get("producer") == args.producer
             for architecture in package.get("architectures", [])
         }
-        if emitted != expected:
+        if args.complete and emitted != expected:
             missing = sorted(expected - emitted)
             unexpected = sorted(emitted - expected)
             if missing: