versions: the kernel follows mainline

.github/taskgate-allow.txt

@@ -0,0 +1,25 @@
+# What taskgate allows on purpose (go tool taskgate -allow, from task lint). Each line is a key and
+# its why: a workflow step that is not one `task <name>`, as <file>/<job>/<step>; a task's shell
+# over twelve lines, as <file>:<task>; a script a task runs that is a program - over forty lines of
+# shell, or deciding anything by GITHUB_OUTPUT, GITHUB_ENV or jq - by its path. The list may shrink
+# and may not grow: a line that matches nothing fails too.
+#
+# Every line here was over the limit when go-tools set it, and is work owed: what decides goes to Go
+# with a test, what drives tools in order stays shell once it is short.
+Taskfile.yml:coverage  # formats the coverage profile for the run's summary: Go
+Taskfile.yml:release:version  # decides the next CalVer from the tags: Go
+Taskfile.yml:release:notes  # writes the release's notes from git and the pins: Go
+Taskfile.yml:release:sign  # drives cosign over the release's files: shell, once shorter
+Taskfile.yml:shell  # assembles a spin-machine boot with a shell for a person: spin-machine's own flags
+Taskfile.yml:lab:unpack  # fetches and unpacks a release for the lab: shell, once shorter
+Taskfile.yml:lab:place  # lays the lab's tree out from a release: Go, beside hack/machine place
+Taskfile.yml:lab:vars  # decides the lab's variables from its inputs: Go
+Taskfile.yml:lab:about  # reports the run and its host on the summary: Go, with report:runner
+Taskfile.yml:report:runner  # reports what the host can measure: Go
+Taskfile.yml:report:compare  # compares two runs' numbers: Go
+boot/Taskfile.yml:previous  # fetches the previous release for boot:compat: shell, once shorter
+boot/Taskfile.yml:here  # builds this tree's release for boot:compat: shell, once shorter
+qemu/Taskfile.yml:verify  # asserts the QEMU tree's devices and files: Go, with a test
+hack/release  # assembles and refuses a release tarball: Go, with a test
+hack/fingerprint-diff  # decides by jq which fingerprint inputs changed: Go, beside machine.Spec.Fingerprint
+image/build.sh  # builds the base image and asserts it carries no identity: shell that drives mkfs, its assertions Go

Taskfile.yml

@@ -224,7 +224,7 @@ tasks:
       - go tool testquality ./...
       - go tool refs
       - go tool mutate -stale-exempts
-      - go tool taskgate
+      - go tool taskgate -allow .github/taskgate-allow.txt
       - go tool sfw check
       - task: lint:workflows
 

go.mod

@@ -19,7 +19,7 @@ tool (
 )
 
 require (
-	github.com/spin-stack/go-tools v0.0.0-20261024191920-5824d9a153be
+	github.com/spin-stack/go-tools v0.0.0-20261029182133-98ef7f26cc6d
 	golang.org/x/sys v0.49.0
 )
 

go.sum

@@ -241,8 +241,8 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spiffe/go-spiffe/v2 v2.8.1 h1:eXZMLsu+3MLEPJyGJkolqtVrteZfQdUpOWj6LTiDl/E=
 github.com/spiffe/go-spiffe/v2 v2.8.1/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
-github.com/spin-stack/go-tools v0.0.0-20261024191920-5824d9a153be h1:NzmdrDxCGDUvuXDP4TLz7FVJlB71bLI1fFue8MuqL44=
-github.com/spin-stack/go-tools v0.0.0-20261024191920-5824d9a153be/go.mod h1:AjnMnKNXxvNt1n0zTkHpABmBd+NnNBqdRMSwmYu885Y=
+github.com/spin-stack/go-tools v0.0.0-20261029182133-98ef7f26cc6d h1:ptkFQULaFS5j5woTE8Z0NfVPNEp8d/UgS3eVIFEYGoI=
+github.com/spin-stack/go-tools v0.0.0-20261029182133-98ef7f26cc6d/go.mod h1:AjnMnKNXxvNt1n0zTkHpABmBd+NnNBqdRMSwmYu885Y=
 github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=

versions.yaml

@@ -28,6 +28,7 @@
 #            digest          the tag's digest now: the version stays, the image moves
 #            today           today's date
 #            kernel-stable   the newest release of the same stable series
+#            kernel-mainline the newest series Linus released, its first tarball
 #            tags <repo>     the highest version-numbered tag of a git repository
 #            branch          the commit the version's branch is at now
 #            commit <repo> <branch>
@@ -70,15 +71,14 @@
   source: https://cdn.kernel.org/pub/linux/kernel/v{major}.x/linux-{version}.tar.xz
   version: 7.3
   pin: 87363c24f10e06321eb362765521094e94471f6bff8bce2d6b3e40f39f004953
-  track: kernel-stable
+  track: kernel-mainline
   note: >-
     kernel/Dockerfile. A new kernel for every guest's next boot; checkpoints keep resuming, each
     on the kernel it was saved with (machine.Spec.Fingerprint). The configuration
     is kernel/config-<version>-x86_64: rename it to the new version in the same commit, then
-    `task kernel:build`, `task boot:bench`. A series that is over is a decision, not a bump.
-    Pinned at 7.3's release candidates, from git.kernel.org, until 7.3.0 is out: the bump to it
-    moves source back to cdn.kernel.org's .tar.xz. Until then `task versions` reports the 7.3
-    series as over, because kernel.org lists no stable 7.3.y yet.
+    `task kernel:build`, `task boot:bench`. Mainline, the series' first tarball, as spin-ami's
+    host kernel: a bump is the next series, whose config is checked as above, and no stable
+    release of one is taken.
 
 - name: debian
   kind: image