on commit to submodule:
  zephyr
  nothing else?

superrepo heads are dev, prod, and dev-incoming, prod-incoming
on commit to superrepo:
  reject commits to dev, prod
  grab lock or fail
  spawn build process
  zephyr

in build process for foo-incoming:
  for each changed submodule revision:
    (as optimization: if same commit already in dev, just reprepro move)
    try to build submodule
    if fail:
      abort whole build
      clean up any previous packages' built files, maybe keep this one's around
    remember package and version
  for each changed submodule revision:  (if we're still going)
    tag submodule with version
    upload to dev/prod respectively
    clean up built files
  commit to foo
  zephyr?
  release lock
if fail:
  reset foo-incoming to old revision
  send mail with log
  zephyr
  release lock

Maybe there could be something sane without the lock?  It'd require
more thought.