distribution: establish the OS release contract

distribution/README.md

@@ -0,0 +1,45 @@
+# SouveraineOS distribution contract
+
+`SouveraineOS` is the operating-system repository. This directory is its
+release and installation authority.
+
+`../souveraine` is one component: the agent substrate, shell, and the package
+that delivers it. `../Pixel3Arch` is another: device packages and the blueline
+kernel. Neither decides what a SouveraineOS body is, what it installs, or where
+its release lands. Those decisions live here, once.
+
+## What this owns
+
+- `manifest.toml` is the canonical body, package, producer, and installer
+  profile graph.
+- The signed `edge` archive is one multi-producer archive. Its implementation
+  currently lives in `souveraine/packaging/arch/publish-edge.sh`; this manifest
+  names it so consumers do not grow their own publisher.
+- `../tools/validate-distribution.py` checks graph integrity without requiring
+  a runner, a device, or a secret.
+- `.gitea/workflows/distribution.yml` makes that check a gate in the OS repo.
+
+The manifest is deliberately honest about maturity. A profile marked `blocked`
+is a desired composition with named missing work, not an installer claim. Only
+a `ready` profile is eligible for a public installer or release channel.
+
+## The install shape
+
+An eventual graphical installer can be Calamares-shaped, but it must not own a
+second device matrix. It selects one target ID from this manifest, obtains that
+profile's signed packages, applies only its declared boot and device packages,
+then runs the target's commissioning step. The UI is downstream of this file.
+
+The first implementation remains a non-destructive provisioner: resolve a
+target, verify that its profile is `ready`, and emit the exact package and boot
+plan. Partitioning, credential enrollment, and device-local secrets require
+their own explicit installer work.
+
+## Producer rule
+
+Component workflows build code; they do not independently choose the release
+set. A producer may publish only package names and architectures declared here.
+The next pipeline change is to make each producer fetch this manifest at the
+commit carried by its build and reject an undeclared package before
+`publish-edge.sh` runs. That is how a new body becomes one profile and package
+change here, rather than another private chain of scripts.

distribution/manifest.toml

@@ -0,0 +1,115 @@
+# SouveraineOS distribution graph. Component repositories own source and
+# package recipes; this file owns release composition and installer selection.
+schema = 1
+
+[archive]
+repository = "Fimeg/souveraine"
+channel = "edge"
+architectures = ["x86_64", "aarch64"]
+publisher_repository = "Fimeg/souveraine"
+publisher_path = "packaging/arch/publish-edge.sh"
+publisher_rule = "additive"
+
+[producers.souveraine]
+repository = "Fimeg/souveraine"
+workflow = ".gitea/workflows/ci.yml"
+architectures = ["x86_64", "aarch64"]
+
+[producers.souveraine-updater]
+repository = "Fimeg/souveraine-updater"
+workflow = ".gitea/workflows/ci.yml"
+architectures = ["x86_64", "aarch64"]
+
+[producers.pixel3arch]
+repository = "Fimeg/Pixel3Arch"
+workflow = ".gitea/workflows/packages.yml"
+architectures = ["aarch64"]
+
+# Current packages. `managed` means a producer and shared archive path exist;
+# it does not assert that the newest run is green. `blocked` and `planned` are
+# intentionally visible to the installer gate.
+[packages]
+souveraine = { producer = "souveraine", architectures = ["x86_64", "aarch64"], state = "managed" }
+upower-souveraine = { producer = "souveraine", architectures = ["x86_64", "aarch64"], state = "managed" }
+souveraine-updater = { producer = "souveraine-updater", architectures = ["x86_64", "aarch64"], state = "managed" }
+souveraine-viewtop = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+linux-blueline = { producer = "pixel3arch", architectures = ["aarch64"], state = "blocked", blocker = "kernel.yml does not publish into the shared archive" }
+souveraine-callaudio = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+souveraine-callaudiod = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+souveraine-ucm-blueline = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+souveraine-q6voiced = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+hexagonrpc-blueline = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+tqftpserv-blueline = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+blueline-edge-sense = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+souveraine-stevia = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+souveraine-squeekboard = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+souveraine-stt = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+blueline-camera = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+blueline-usb-gadget = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+hyprgrass = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+smoo = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+usb-signaller = { producer = "pixel3arch", architectures = ["aarch64"], state = "managed" }
+linux-d10 = { producer = "d10", architectures = ["aarch64"], state = "planned", blocker = "TASK-64: kernel source home and CI do not exist" }
+souveraine-d10-loader = { producer = "d10", architectures = ["x86_64"], state = "planned", blocker = "TASK-64: m1n1 and patched iBSS chain are not packaged" }
+souveraine-d10-device = { producer = "d10", architectures = ["aarch64"], state = "planned", blocker = "TASK-64: DTB and device quirks are not a package" }
+
+[profiles.generic-aarch64]
+status = "blocked"
+architectures = ["aarch64"]
+packages = ["souveraine", "upower-souveraine", "souveraine-updater"]
+blockers = ["generic ARM provisioning has no completed installer"]
+
+[profiles.blueline]
+status = "blocked"
+architectures = ["aarch64"]
+packages = ["souveraine", "upower-souveraine", "souveraine-updater", "souveraine-viewtop", "linux-blueline", "souveraine-callaudio", "souveraine-callaudiod", "souveraine-ucm-blueline", "souveraine-q6voiced", "hexagonrpc-blueline", "tqftpserv-blueline", "blueline-edge-sense", "souveraine-stevia", "souveraine-squeekboard", "souveraine-stt", "blueline-camera", "blueline-usb-gadget", "hyprgrass", "smoo", "usb-signaller"]
+blockers = ["linux-blueline is not published to the shared archive", "rootfs overlay content still needs package ownership"]
+
+[profiles.x86-laptop]
+status = "blocked"
+architectures = ["x86_64"]
+packages = ["souveraine", "upower-souveraine", "souveraine-updater"]
+blockers = ["laptop installer and hardware profile are not implemented"]
+
+[profiles.d10]
+status = "blocked"
+architectures = ["aarch64"]
+packages = ["souveraine", "upower-souveraine", "souveraine-updater", "linux-d10", "souveraine-d10-device"]
+host_tools = ["souveraine-d10-loader"]
+blockers = ["TASK-64 has no packaged kernel, loader, or device identity yet", "ADP display has no pixel proof"]
+
+[profiles.m1]
+status = "planned"
+architectures = ["aarch64"]
+packages = ["souveraine", "upower-souveraine", "souveraine-updater"]
+blockers = ["no M1 device profile or installer exists"]
+
+[targets.blueline]
+label = "Google Pixel 3 (blueline)"
+architecture = "aarch64"
+profile = "blueline"
+state = "supported"
+
+[targets.generic-aarch64]
+label = "generic ARM64 device"
+architecture = "aarch64"
+profile = "generic-aarch64"
+state = "planned"
+
+[targets.d10]
+label = "iPhone 7 (D10AP / T8010)"
+architecture = "aarch64"
+profile = "d10"
+state = "bringup"
+
+[targets.x86-laptop]
+label = "generic x86_64 laptop"
+architecture = "x86_64"
+profile = "x86-laptop"
+state = "planned"
+
+[targets.m1]
+label = "Apple Silicon laptop"
+architecture = "aarch64"
+profile = "m1"
+state = "planned"