@kungfu-tech/buildchain 2.14.1 → 2.14.2-alpha.1

package/dist/site/public-surface-audit.json

@@ -4,10 +4,10 @@
   "status": "passed",
   "summary": {
     "cliCommandCount": 83,
-    "workflowCount": 47,
+    "workflowCount": 48,
     "actionCount": 4,
     "sitePageCount": 50,
-    "docCommandRefCount": 256,
+    "docCommandRefCount": 257,
     "failureCount": 0
   },
   "enumerated": {
@@ -1233,6 +1233,7 @@
           "cadence",
           "capabilities",
           "dry-run",
+          "landing-mode",
           "max-actions",
           "merge-method",
           "mode",
@@ -1242,7 +1243,7 @@
           "same-repository-only",
           "target-branch"
         ],
-        "inputCount": 15,
+        "inputCount": 16,
         "secrets": [
           "github-token"
         ],
@@ -1327,6 +1328,17 @@
         ],
         "outputCount": 7
       },
+      {
+        "id": "dev-merge-queue-governance",
+        "path": ".github/workflows/dev-merge-queue-governance.yml",
+        "reusable": false,
+        "inputs": [],
+        "inputCount": 0,
+        "secrets": [],
+        "secretCount": 0,
+        "outputs": [],
+        "outputCount": 0
+      },
       {
         "id": "dev-pr-auto-merge",
         "path": ".github/workflows/dev-pr-auto-merge.yml",
@@ -1337,6 +1349,7 @@
           "buildchain-ref",
           "buildchain-repository",
           "dry-run",
+          "landing-mode",
           "max-merges",
           "merge-method",
           "ready-label",
@@ -1345,18 +1358,20 @@
           "same-repository-only",
           "target-branch"
         ],
-        "inputCount": 12,
+        "inputCount": 13,
         "secrets": [
           "github-token"
         ],
         "secretCount": 1,
         "outputs": [
+          "action-count",
+          "enqueued-count",
           "evaluated-count",
           "final-base-sha",
           "merged-count",
           "skipped-count"
         ],
-        "outputCount": 4
+        "outputCount": 6
       },
       {
         "id": "npm-publish",
@@ -1486,6 +1501,7 @@
           "buildchain-ref",
           "buildchain-repository",
           "dry-run",
+          "landing-mode",
           "max-actions",
           "merge-method",
           "ready-label",
@@ -1494,7 +1510,7 @@
           "same-repository-only",
           "target-branch"
         ],
-        "inputCount": 12,
+        "inputCount": 13,
         "secrets": [
           "github-token"
         ],
@@ -2430,6 +2446,11 @@
         "path": "docs/cli.md",
         "command": "buildchain dev merge-queue"
       },
+      {
+        "id": "dev",
+        "path": "docs/cli.md",
+        "command": "buildchain dev merge-queue --from-config"
+      },
       {
         "id": "dev",
         "path": "docs/release-governance.md",
@@ -3482,8 +3503,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "b469949f77ed7777f23fe68c54daf6d2c20d3afc97f3bbd5a178a91202a068d0",
-    "workflowRegistryDigest": "62b7ca87803c461e1e1436a477c3b6b70103eed84dbf14d855d383e810d7d71e",
-    "pageRegistryDigest": "c76ebcc729f2c9922605e02ba369c8e839064d6090735362ec3fc4983a20accb"
+    "workflowRegistryDigest": "2ad4284a9e275cec6fbc6593a470f9d443e26f7aa880bedf9fa0671448369f2f",
+    "pageRegistryDigest": "53c5c0918268a1ea769a3841ad3b5ad553e81b0fcd602c8289dc049e3559ff89"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-authority-registry.json

@@ -280,6 +280,19 @@
       "runnerPolicy": "unqualified",
       "notes": ""
     },
+    {
+      "workflowPath": ".github/workflows/dev-merge-queue-governance.yml",
+      "authorityClass": "governance-write",
+      "publicationCapable": false,
+      "capabilityIds": [],
+      "credentialMode": "none",
+      "publisherWorkflowMode": "fixed",
+      "publisherWorkflowPath": ".github/workflows/dev-merge-queue-governance.yml",
+      "environment": "",
+      "environmentMode": "fixed",
+      "runnerPolicy": "unqualified",
+      "notes": ""
+    },
     {
       "workflowPath": ".github/workflows/dev-pr-auto-merge.yml",
       "authorityClass": "governance-write",
@@ -657,6 +670,11 @@
       "signals": [],
       "classified": false
     },
+    {
+      "path": ".github/workflows/dev-merge-queue-governance.yml",
+      "signals": [],
+      "classified": true
+    },
     {
       "path": ".github/workflows/dev-pr-auto-merge.yml",
       "signals": [
@@ -774,5 +792,5 @@
       "classified": false
     }
   ],
-  "registryDigest": "760215fb39e6c85890c925e924c538a766d78abd6319794c8799fb47c23dec3d"
+  "registryDigest": "24c7f5210da277b79ce13356c439c14ea49f6c54ba9e083f42ce47fdfdacc55c"
 }

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-07-17T00:55:24.253Z",
-  "publishedAt": "2026-07-17T00:55:24.253Z",
+  "generatedAt": "2026-07-17T06:47:39.218Z",
+  "publishedAt": "2026-07-17T06:47:39.218Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "d962181c3023e587488a5276b10307007cc5a13f",
+  "sourceRevision": "4f111d56131695265eaf786eb86cae5202247111",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.1",
+    "version": "2.14.2-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-07-17T00:55:24.253Z",
-  "publishedAt": "2026-07-17T00:55:24.253Z",
+  "generatedAt": "2026-07-17T06:47:39.218Z",
+  "publishedAt": "2026-07-17T06:47:39.218Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "d962181c3023e587488a5276b10307007cc5a13f",
+  "sourceRevision": "4f111d56131695265eaf786eb86cae5202247111",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "2.14.1",
+    "version": "2.14.2-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -189,7 +189,7 @@
       "path": "docs/cli.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:9ecf8c220b5ff02ee5719cb877d4b2b159c3d683af288630eae0013d9d906373"
+      "digest": "sha256:1733f9377938a16e6de77511546be7de67c5ab8816220d693fd46f55450a5148"
     },
     {
       "id": "build-facts",
@@ -229,7 +229,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:cc2f4c9d2b9988962a237bbc7e8da83385d45585e2b2dd105ff4c4334a74c05d"
+      "digest": "sha256:950ca4fb2f7ab0a7d40775593e3864f8bb1229f8543b266b00154af82c619e95"
     },
     {
       "id": "release-governance",
@@ -237,7 +237,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:5cf4bf4332119531f6aaa1c123d7f64e6af4a61611c4e4a33d40bd9fb46448cf"
+      "digest": "sha256:e64ffd6183eaa7b73f8c0c133a645ced22212bca70c9609ad5f667cf3830aaae"
     },
     {
       "id": "release-flow",
@@ -245,7 +245,7 @@
       "path": "docs/release-flow.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:a2f68d42f34acc35940e135285df5ba510d91b15b9d9ede8cabbe8bfa6ab0305"
+      "digest": "sha256:fc6495a7b5124c17c880777e16fc98e60ed7766ec9a958abfca3030bdc2c321e"
     },
     {
       "id": "runtime-train-validation",
@@ -261,7 +261,7 @@
       "path": "docs/versioning.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:c3dce313b846fb36c69e4a725d086226ff2e875c376cc10e8554a0aff2f67c93"
+      "digest": "sha256:e856ec8aee11ff4bd2760425a8950538a91245cd5624c22c8768af50d6b1a8ce"
     },
     {
       "id": "web-surface-deployments",
@@ -269,7 +269,7 @@
       "path": "docs/web-surface-deployments.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:797d8f0e81974a49125b17256bb8b4a85fc60673e06d6bbecbbf399651163437"
+      "digest": "sha256:856a7602cf1c2d3a0a540cdf0d64566914f79dde24417c92089f0466bee25df1"
     }
   ],
   "facts": [

package/dist/site/workflow-registry.json

@@ -879,6 +879,7 @@
         "cadence",
         "capabilities",
         "dry-run",
+        "landing-mode",
         "max-actions",
         "merge-method",
         "mode",
@@ -888,7 +889,7 @@
         "same-repository-only",
         "target-branch"
       ],
-      "inputCount": 15,
+      "inputCount": 16,
       "secrets": [
         "github-token"
       ],
@@ -991,6 +992,20 @@
       "capabilityGroup": "api-cli-reference",
       "status": "active"
     },
+    {
+      "id": "dev-merge-queue-governance",
+      "path": ".github/workflows/dev-merge-queue-governance.yml",
+      "reusable": false,
+      "inputs": [],
+      "inputCount": 0,
+      "secrets": [],
+      "secretCount": 0,
+      "outputs": [],
+      "outputCount": 0,
+      "surface": "repository-workflow",
+      "capabilityGroup": "api-cli-reference",
+      "status": "active"
+    },
     {
       "id": "dev-pr-auto-merge",
       "path": ".github/workflows/dev-pr-auto-merge.yml",
@@ -1001,6 +1016,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "dry-run",
+        "landing-mode",
         "max-merges",
         "merge-method",
         "ready-label",
@@ -1009,18 +1025,20 @@
         "same-repository-only",
         "target-branch"
       ],
-      "inputCount": 12,
+      "inputCount": 13,
       "secrets": [
         "github-token"
       ],
       "secretCount": 1,
       "outputs": [
+        "action-count",
+        "enqueued-count",
         "evaluated-count",
         "final-base-sha",
         "merged-count",
         "skipped-count"
       ],
-      "outputCount": 4,
+      "outputCount": 6,
       "surface": "dev-governance",
       "capabilityGroup": "governance-versioning",
       "status": "active"
@@ -1162,6 +1180,7 @@
         "buildchain-ref",
         "buildchain-repository",
         "dry-run",
+        "landing-mode",
         "max-actions",
         "merge-method",
         "ready-label",
@@ -1170,7 +1189,7 @@
         "same-repository-only",
         "target-branch"
       ],
-      "inputCount": 12,
+      "inputCount": 13,
       "secrets": [
         "github-token"
       ],

package/docs/cli.md

@@ -208,6 +208,31 @@ required status checks from strict to loose, preserves the required check
 identities, and is safe to repeat. `gh` must be authenticated with repository
 Administration write permission for apply mode.
 
+Repositories can make that policy declarative in `buildchain.toml`:
+
+```toml
+[governance.dev.merge_queue]
+mode = "enabled" # enabled, inherit, or disabled
+required_workflows = [".github/workflows/verify.yml"]
+check_response_timeout_minutes = 120
+max_entries_to_build = 1
+bypass_users = ["release-owner"]
+```
+
+Use `buildchain dev merge-queue --from-config` to resolve and reconcile the
+declaration. `enabled` requires an exact queue on the target dev branch;
+`disabled` suppresses automatic queue creation; `inherit` copies the active
+default dev branch's queue parameters and bypass actors. When the table is
+absent, release-line bootstrap uses the backward-compatible `inherit` mode.
+Every inherited or explicitly enabled queue still validates each declared
+required workflow before any mutation. For a legacy repository with no table,
+an already-active exact queue on the current default dev branch is accepted as
+the inheritance evidence; new declarations should list the workflows so future
+changes are revalidated from source.
+The `Dev Merge Queue Governance` workflow runs this reconciliation after
+governance-relevant changes land on a dev branch; its manual dispatch remains
+dry-run by default.
+
 `buildchain release line open` plans or writes the first version-state commit
 for a new semver minor line. It does not publish anything. The dry-run mode is
 the default and returns the dev/alpha/release refs, protection contract, default
@@ -224,8 +249,9 @@ buildchain release line open \
 The write mode only updates local version-state files. The repository workflow
 `Release Line Bootstrap` wraps this command and, when `apply=true`, commits the
 initial version state, creates `dev/vX/vX.Y`, `alpha/vX/vX.Y`, and
-`release/vX/vX.Y`, applies one-review branch protection, switches the default
-branch, and opens the first dev-to-alpha channel PR:
+`release/vX/vX.Y`, applies one-review branch protection, reconciles declared or
+inherited merge-queue governance, switches the default branch only after that
+reconciliation succeeds, and opens the first dev-to-alpha channel PR:
 
 ```bash
 buildchain release line open \

package/docs/publish-transaction.md

@@ -395,6 +395,20 @@ last transient error seen before a rerun.
 An exact tag at an unrelated SHA is still a material conflict and blocks
 recovery.
 
+Governed retries distinguish unrelated channel advancement from advancement
+made by their own durable transaction. An unrelated descendant remains an
+auditable `superseded-promotion` no-op. When the target ref is exactly the
+recorded `release_sha` for the requested source, target, and expected version,
+Buildchain resumes finalization, restores publish evidence, and emits the
+release-passport paths needed by downstream controller receipts.
+
+Publication authority planning applies the same occupied-version rule as the
+later mutation step. If a current alpha transaction already contains published
+material and regenerating version state would create new release material, the
+planner advances to the next alpha before sealing authority. It never seals the
+old published version and then lets the publisher discover a different version
+inside the mutation boundary.
+
 If finalization fails after an exact Git tag is created, the next run reads the
 durable `finalizing` state, verifies the exact tag points at the recorded
 release SHA, and retries the remaining floating refs. An exact tag at a

package/docs/release-flow.md

@@ -108,12 +108,17 @@ When the workflow is run with `apply=true`, Buildchain:
 - applies branch protection with one approving review and the configured
   required status check; dev starts strict, while alpha and release also require
   the pair-specific `verify` aggregate without a source-up-to-date ancestry loop;
+- reconciles the new dev branch's explicitly declared merge queue, or inherits
+  the exact queue parameters and bypass actors from the current default dev
+  branch when the policy is `inherit` or absent;
 - switches the repository default branch to the new dev line when requested;
 - opens the first `dev/v2/v2.10 -> alpha/v2/v2.10` channel PR when requested.
 
 This makes minor-line creation a single audited operation. The channel PR still
 goes through the normal verify/review/promotion path before an alpha is
-published.
+published. Queue reconciliation runs after branch protection and before the
+default-branch switch, so a failed governance apply leaves the old active line
+in place and the idempotently created new refs can be retried.
 
 ## Alpha Promotion
 

package/docs/release-governance.md

@@ -411,7 +411,8 @@ buildchain dev merge-queue \
   --repository owner/repository \
   --branch dev/v4/v4.0 \
   --workflow .github/workflows/source-acceptance.yml \
-  --workflow .github/workflows/affected-native-pr.yml
+  --workflow .github/workflows/affected-native-pr.yml \
+  --bypass-app dedicated-release-app
 ```
 
 After reviewing the plan, repeat with `--apply`. Buildchain creates or updates
@@ -423,6 +424,31 @@ protection. The ruleset uses the first merge method that the repository itself
 allows, and fails closed when the repository has no enabled merge method.
 Re-running the command is idempotent.
 
+The repository policy can be declared once instead of repeated as CLI flags:
+
+```toml
+[governance.dev.merge_queue]
+mode = "inherit"
+required_workflows = [".github/workflows/verify.yml"]
+```
+
+`enabled` explicitly requires Buildchain to create or update an exact-branch
+queue; `inherit` copies queue parameters and bypass actors from the repository's
+current default dev branch; `disabled` prevents automatic queue creation. An
+absent declaration behaves as `inherit` during release-line bootstrap so a new
+major or minor line does not silently lose governance already active on the
+previous line. Required status-check identities still come from the new
+branch's own classic protection rather than being copied from the old branch.
+
+Merge-queue rules also reject generated post-publish version-state ref updates.
+When the sealed promotion workflow uses a dedicated GitHub App, user, or team
+already declared by release governance, repeat `--bypass-app`, `--bypass-user`,
+or `--bypass-team` to project that exact actor into the ruleset. Bypass actors
+are never inferred and broad repository or organization roles are not accepted.
+This keeps ordinary feature PRs on the predecessor-aligned queue path while the
+sealed publication authority can finish its machine-verified bookkeeping. The
+dry-run receipt exposes the exact actor IDs before `--apply` changes GitHub.
+
 Buildchain provides the reusable
 `.github/workflows/dev-pr-auto-merge.yml` workflow for repositories that want a
 scheduled or manual "merge ready dev PRs" pass. The consumer repository owns
@@ -435,9 +461,21 @@ The workflow defaults are conservative. A PR is skipped unless it targets the
 configured dev line, is not a draft, has the ready label, has no block label,
 comes from the same repository, uses an allowed work-branch prefix, has a
 current approval, is mergeable, and has the configured required checks passing.
-After each merge, the next PR is re-evaluated before it can move the protected
-dev branch. This prevents one merge from silently making the next candidate
-stale or conflicting.
+`landing-mode: auto` reads the target branch's native merge-queue state. When a
+queue exists, Buildchain never calls the direct merge endpoint: it admits at
+most one PR against the observed target-branch SHA and immutable PR head, then
+calls GraphQL `enqueuePullRequest` with `expectedHeadOid`. GitHub's
+`merge_group` checks remain the final authority for the projected merge.
+
+The admission receipt records the expected and observed base/head SHAs, policy
+checks, decision, reason, and active predecessor. Buildchain re-reads the base,
+head, mergeability, and native queue immediately before enqueueing. Base or
+head drift fails closed, an active queue entry blocks admission, and a rejected
+ready predecessor leaves its PR open while later PRs receive
+`blocked-by-predecessor`. Workflow concurrency serializes Buildchain-owned
+admission runs; GitHub still owns the atomic queue and protected-ref update.
+Repositories may explicitly select `landing-mode: direct` only when the target
+branch has no native queue. Queue presence always disables the direct path.
 
 The canonical consumer required check context is `check / check`, matching the
 reusable workflow call plus its `check` job. Buildchain's own `Verify` workflow
@@ -497,6 +535,7 @@ jobs:
       ready-label: ready
       block-labels: blocked,do-not-merge
       max-merges: 1
+      landing-mode: auto
       dry-run: ${{ inputs.dry-run || false }}
 ```
 

package/docs/versioning.md

@@ -61,6 +61,7 @@ repository changes are patch".
 
 | Date | Action | Line | Faces | Class | Rationale | PR |
 | --- | --- | --- | --- | --- | --- | --- |
+| 2026-07-17 | extend-minor | `v2.14` | merge-queue-config, release-line-governance-inheritance | additive | Buildchain config can explicitly enable, inherit, or disable exact dev-channel merge queues, and release-line bootstrap reconciles the declared or inherited policy before moving the repository default branch. | |
 | 2026-07-16 | open-minor | `v2.14` | dev-merge-queue-governance | additive | The public CLI adds a dry-run-first, idempotent merge-queue governance command that verifies required workflow event compatibility before applying an exact dev-channel ruleset and removing the strict up-to-date race. | |
 | 2026-07-15 | open-minor | `v2.13` | artifact-verification-envelope, package-subpaths | additive | The public envelope seals exact artifact, provenance, identity, lifecycle, revocation, and existing KFD assessment roots into one consumer-ready KFX admission input, with a dedicated Node API export and fail-closed verifier. | |
 | 2026-07-11 | open-minor | `v2.12` | channel-build-router, channel-selection-protocol | additive | The public `build.yml` reusable workflow lets consumers declare one build job while Buildchain selects generic major alpha for development/prerelease intent and stable major for production release intent, with explicit overrides, separate locks, and fail-closed ambiguity handling. | |

package/docs/web-surface-deployments.md

@@ -745,7 +745,10 @@ When enabled, Buildchain owns the full release apply state machine:
   operator can verify staging from the PR page and use merge as the approval
   action. Consumers do not need to hand-write `gh pr create` or production
   release-intent glue.
-- Production runs when `production-apply` is true and either:
+- `production-apply=true` enables the production capability; it does not request
+  production for every event. Ordinary `main` pushes remain staging-only and
+  can create or update a release PR. Production runs only when the capability
+  is enabled and either:
   - a `workflow_dispatch` passes `production-approved=true` and the triggering
     actor currently has `write`, `maintain`, or `admin` permission; or
   - `production-release-on-main=true` and the `main` push commit is associated
@@ -794,7 +797,7 @@ jobs:
       build-command: npm run build
       verify-command: npm run check
       artifact-path: dist
-      production-apply: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
+      production-apply: true
       production-release-on-main: true
       production-release-label: buildchain-release
       production-release-head-prefix: release/
@@ -804,6 +807,13 @@ jobs:
       production-environment: production
 ```
 
+Keep `production-apply` enabled in the caller when the repository supports
+production. Buildchain derives whether the current event may use that
+capability: an ordinary `main` push plans and applies staging, a matching
+reviewed release PR merge authorizes production, and an approved trusted manual
+dispatch authorizes production. Inputs from an untrusted event cannot turn that
+decision on.
+
 `production-release-pr-mode` controls the post-staging handoff:
 
 | Mode | Behavior |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "2.14.1",
+  "version": "2.14.2-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/buildchain-config.js

@@ -20,6 +20,7 @@ const SUPPORTED_PUBLISH_AUTH = new Set(["trusted-publishing", "npm-token"]);
 const SUPPORTED_PUBLISH_KINDS = new Set(["npm-package", "npm-paper-package"]);
 const SUPPORTED_PACKAGE_SET_ORDER = new Set(["as-provided", "platforms-first-main-last"]);
 const SUPPORTED_STABLE_RELEASE_STRATEGIES = new Set(["manual", "latest-qualified-alpha"]);
+const SUPPORTED_MERGE_QUEUE_MODES = new Set(["inherit", "enabled", "disabled"]);
 const SUPPORTED_NATIVE_COMPILER_CACHE = new Set(["auto", "ccache", "sccache", "none"]);
 const WEB_SURFACE_CHANNELS = ["preview", "staging", "production"];
 const SUPPORTED_CHANNEL_VISIBILITY = new Set(["ephemeral", "protected", "public", "internal"]);
@@ -184,6 +185,9 @@ export function normalizeBuildchainConfig(config) {
   if (normalized.release !== undefined) {
     normalized.release = normalizeReleaseSection(normalized.release);
   }
+  if (normalized.governance !== undefined) {
+    normalized.governance = normalizeGovernanceSection(normalized.governance);
+  }
   if (normalized.channels !== undefined) {
     normalized.channels = normalizeChannelsSection(normalized.channels, normalized.project);
   }
@@ -219,6 +223,53 @@ export function normalizeBuildchainConfig(config) {
   return normalized;
 }
 
+function normalizeGovernanceSection(governance) {
+  assertPlainObject(governance, "governance");
+  const normalized = { ...governance };
+  if (governance.dev !== undefined) {
+    assertPlainObject(governance.dev, "governance.dev");
+    normalized.dev = { ...governance.dev };
+    if (governance.dev.merge_queue !== undefined) {
+      const mergeQueue = assertPlainObject(governance.dev.merge_queue, "governance.dev.merge_queue");
+      const mode = mergeQueue.mode === undefined
+        ? "inherit"
+        : assertString(mergeQueue.mode, "governance.dev.merge_queue.mode");
+      if (!SUPPORTED_MERGE_QUEUE_MODES.has(mode)) {
+        throw new Error("governance.dev.merge_queue.mode must be one of inherit, enabled, or disabled");
+      }
+      const checkResponseTimeoutMinutes = mergeQueue.check_response_timeout_minutes === undefined
+        ? 120
+        : Number(mergeQueue.check_response_timeout_minutes);
+      const maxEntriesToBuild = mergeQueue.max_entries_to_build === undefined
+        ? 1
+        : Number(mergeQueue.max_entries_to_build);
+      if (!Number.isInteger(checkResponseTimeoutMinutes) || checkResponseTimeoutMinutes < 1) {
+        throw new Error("governance.dev.merge_queue.check_response_timeout_minutes must be a positive integer");
+      }
+      if (!Number.isInteger(maxEntriesToBuild) || maxEntriesToBuild < 1) {
+        throw new Error("governance.dev.merge_queue.max_entries_to_build must be a positive integer");
+      }
+      normalized.dev = {
+        ...governance.dev,
+        mergeQueue: {
+          mode,
+          requiredWorkflows: normalizeStringArray(
+            mergeQueue.required_workflows,
+            "governance.dev.merge_queue.required_workflows",
+          ),
+          checkResponseTimeoutMinutes,
+          maxEntriesToBuild,
+          bypassApps: normalizeStringArray(mergeQueue.bypass_apps, "governance.dev.merge_queue.bypass_apps"),
+          bypassUsers: normalizeStringArray(mergeQueue.bypass_users, "governance.dev.merge_queue.bypass_users"),
+          bypassTeams: normalizeStringArray(mergeQueue.bypass_teams, "governance.dev.merge_queue.bypass_teams"),
+        },
+      };
+      delete normalized.dev.merge_queue;
+    }
+  }
+  return normalized;
+}
+
 function normalizeReleaseSection(release) {
   assertPlainObject(release, "release");
   const normalized = { ...release };
@@ -1451,6 +1502,7 @@ export function validateBuildchainConfig(
     lifecycleStages,
     publish: loadedConfig.config.publish,
     release: loadedConfig.config.release,
+    governance: loadedConfig.config.governance,
     facts: loadedConfig.config.facts,
     publication: loadedConfig.config.publication,
   };

package/packages/core/buildchain-publication-authority.js

@@ -25,6 +25,7 @@ const DESCRIPTORS = Object.freeze([
   [".github/workflows/buildchain-patrol.yml", "governance-write"],
   [".github/workflows/buildchain-ref-promotion.yml", "governance-write"],
   [".github/workflows/buildchain-stable-candidate-patrol.yml", "governance-write"],
+  [".github/workflows/dev-merge-queue-governance.yml", "governance-write"],
   [".github/workflows/dev-pr-auto-merge.yml", "governance-write"],
   [".github/workflows/npm-publish.yml", "dry-run-only"],
   [".github/workflows/paper-release-sealed.yml", "product-publication", true, ["npm-publish", "github-release"], "trusted-publishing", "none", "fixed", "caller-bound"],