diff --git a/.github/public-workflow-action-allowlist.json b/.github/public-workflow-action-allowlist.json
index c399b323..15b48516 100644
--- a/.github/public-workflow-action-allowlist.json
+++ b/.github/public-workflow-action-allowlist.json
@@ -1,60 +1,4 @@
 [
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "uses": "actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae",
-    "nodeSHA256": "75285419b94ac7c3e82c6bcdff625ac1aab862ff09465c03b7f67b5f68a187f2",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Pinned actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae for reviewed benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "uses": "actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae",
-    "nodeSHA256": "89a251c63db3bcac9145c65adeb9dddd48afdd5c8cb13a9ad5ae16a3cd3f526f",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Pinned actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae for reviewed benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "uses": "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10",
-    "nodeSHA256": "53ad3f241f5c8d1d03bf90f108b1cc142bb2f4639861d07e4ecc910983808995",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Pinned actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 for reviewed benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "uses": "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3",
-    "nodeSHA256": "b1570fa9a4d99988920c8c534c481885469c1dfaca2327d7c088e35dadb1a568",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Pinned actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 for reviewed benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "uses": "actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c",
-    "nodeSHA256": "c0d85fe8f94bd2187fb4d2a57310b75cf4561a018bc15a11b5fbea0baa13f07a",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Pinned actions/setup-go for the reviewed Go 1.26.5 benchmark toolchain."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "uses": "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e",
-    "nodeSHA256": "d6511486d7f0d7044978b8c71828add2508e72a9897718b7a91fdf151ffb3c49",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Pinned actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e for reviewed benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
-    "nodeSHA256": "12074f39596f10a86be9803abfc22df487bd693298254d1147668ad32952b442",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Pinned actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a for reviewed benchmark.yml automation."
-  },
   {
     "path": ".github/workflows/ci.yml",
     "uses": "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10",
@@ -660,7 +604,7 @@
     "uses": "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10",
     "nodeSHA256": "53ad3f241f5c8d1d03bf90f108b1cc142bb2f4639861d07e4ecc910983808995",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair action."
   },
   {
@@ -668,7 +612,7 @@
     "uses": "actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c",
     "nodeSHA256": "c0d85fe8f94bd2187fb4d2a57310b75cf4561a018bc15a11b5fbea0baa13f07a",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair action."
   },
   {
@@ -676,7 +620,7 @@
     "uses": "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e",
     "nodeSHA256": "d6511486d7f0d7044978b8c71828add2508e72a9897718b7a91fdf151ffb3c49",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair action."
   },
   {
@@ -684,7 +628,7 @@
     "uses": "actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae",
     "nodeSHA256": "75285419b94ac7c3e82c6bcdff625ac1aab862ff09465c03b7f67b5f68a187f2",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair action."
   },
   {
@@ -692,7 +636,7 @@
     "uses": "actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3",
     "nodeSHA256": "b1570fa9a4d99988920c8c534c481885469c1dfaca2327d7c088e35dadb1a568",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair action."
   },
   {
@@ -700,7 +644,7 @@
     "uses": "actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae",
     "nodeSHA256": "89a251c63db3bcac9145c65adeb9dddd48afdd5c8cb13a9ad5ae16a3cd3f526f",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair action."
   },
   {
@@ -708,7 +652,7 @@
     "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
     "nodeSHA256": "1405962dcbf154f33a16a10fef5272ba0a865f20dfe11358a522e310e29dab1c",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair action."
   },
   {
diff --git a/.github/public-workflow-authority.json b/.github/public-workflow-authority.json
index 8d3a57a4..6f290eab 100644
--- a/.github/public-workflow-authority.json
+++ b/.github/public-workflow-authority.json
@@ -156,6 +156,163 @@
         }
       ],
       "state": "active"
+    },
+    {
+      "files": [
+        {
+          "path": ".github/workflows/policytool/adoptionguard/main.go",
+          "sha256": "7854ccaa9593bc5d64eb93db78ec1bdd6b36d61b545bada95df34ce542f2002a"
+        },
+        {
+          "path": ".github/workflows/policytool/adoptionguard/main_test.go",
+          "sha256": "b146ba9688e6aa2d4d72879263875e1a189768894552efeb3087179e5c0651cd"
+        },
+        {
+          "path": ".github/workflows/policytool/adoptionguard/run.sh",
+          "sha256": "b5597c106885bdc9b1f7161f7c6a1635d92f5f9273c41ec799233d68d6dbf3e4"
+        },
+        {
+          "path": ".github/workflows/policytool/go.mod",
+          "sha256": "0a2d135980310757f36e733161b94498b4e0a1b6ac8c6de8a799f542d6c9ddb8"
+        },
+        {
+          "path": ".github/workflows/policytool/go.sum",
+          "sha256": "790ef858e5aeed12269a69e764ac69c02c3877678b0e7d9384ad3728b6e09f6c"
+        },
+        {
+          "path": ".github/workflows/policytool/main.go",
+          "sha256": "9c38f6e1a92d34d31cd73ba2bd2b092216ab9c115af79a0ef5ec13343c4f4d2d"
+        },
+        {
+          "path": ".github/workflows/policytool/main_test.go",
+          "sha256": "fadde1edd916918a69f912177a74565a6138ed935aae3509d7c6082924467778"
+        },
+        {
+          "path": ".github/workflows/scripts/verify-public-workflow-branch-protection.sh",
+          "sha256": "0d48038f7e641f0a58ae2a0f9150d40f284619c2254951fb31066fbb121df304"
+        },
+        {
+          "path": "scripts/check-public-workflow-policy.sh",
+          "sha256": "2cf3f0461ceed4a3e32265ccad7fd3ac1ae4e162d1f2cb19ba9b8737405db02a"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/lifecycle-future.yml",
+          "sha256": "de3bdf01a31d2a0d39a279a65258d47f0f504155065de720a1908a1b7a703103"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/lifecycle-old.yml",
+          "sha256": "6dc23984617b91711ff14a08e8d428d9dc47dc3c00f4efd703bf747fe7e6a122"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/pass-expression-and-deny-guard.yml",
+          "sha256": "6af7ce9692c0e3c3f4468927912db334bab659b36567703e27cd9d2c0957d908"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/pass-negative-guard.yml",
+          "sha256": "7af97a7da7d416064190ba39e6829148071714d39840dc7f354cab78fadc3665"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/pass.yml",
+          "sha256": "38ece391dcb2d2b84ba44121cd6bdcc2953a3822ab0e464224e0bb60199400e5"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-builtin-wrapper.yml",
+          "sha256": "56fcfd4f7752e6b462471a78b329bbf6e8d978fa047c4bdbf9d09b25cc350be0"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-command-analysis.yml",
+          "sha256": "589658280ae8623d932e691323b138c439a28fe27a79ea2859be7c00600b6820"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-deny-pattern-execution.yml",
+          "sha256": "c8475ed82b6fb7ac4ec227f48becc4a148d7d3665a5fdfdbac19096cca7c2165"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-dynamic-secrets.yml",
+          "sha256": "7900842a6adf772396eb4893925d26b71e1a4560053305031d7c4e15b3e2f5f8"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-env-indirection.yml",
+          "sha256": "6b524ac4c498f45d68896676f75c8171033558a9a270f5158870ae36604218d7"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-execution-context.yml",
+          "sha256": "50629e545d7fba12247f28a06e9632b52c3c8d63c01a2551fb8d9d7ac2a6e0b6"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-global.yml",
+          "sha256": "43620c1094cf6a8223f4b35c18bf54a621e09b5f5922b835bd7e22a48f1f205d"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-guard-suffix.yml",
+          "sha256": "4b5623b44d1dcef0198ce914a16a358180f65d733d5521863b4606178ea20823"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-implicit-permissions.yml",
+          "sha256": "5606653732f73c8c9af42c28a72f5d2a43336fd0edbb25524832e98713e798a8"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-legacy-github-token.yml",
+          "sha256": "595e24dcd363104586f7c973225cf6ba79606dfc1b9124ef383c668932e9fb5a"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-missing-shell.yml",
+          "sha256": "58757a1e09107185710dd3a2c401d6a3691d1c11f4db7f41b8a4f8dde57d0574"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-permissions.yml",
+          "sha256": "24ac3b5c02f97b7b3ec2e06f2d7c7c46035a17dda029ed8918c3e54d8e6933c4"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-provider-uses.yml",
+          "sha256": "3f6a028a527a04b1bcddd087174b56b85916fc347da23cb86b76948b2a006f45"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-runners.yml",
+          "sha256": "cbfec39b289dfcbee247f6fa5a415c01921ab02e03c63bd974df1322a6159050"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-script-execution.yml",
+          "sha256": "6e57329ba154ee32a37c2c8227f75db5422d9fdf3487180f4f8d388891c04f62"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-secret-syntax.yml",
+          "sha256": "3ef3fc0c94a53510069d63e58e7a7eef51de884d7446fe20476d60c4fa078648"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-shell-inheritance.yml",
+          "sha256": "330bc5a511a1c14d6adadd7e7f19a1baacdf47b513a2382e7cfa060babc460e0"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-shell.yml",
+          "sha256": "6dffd2756cf468c9bf4c268bfebfd1c4bfb96e81e30137a7dafbd0d39161df00"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-statement-authority.yml",
+          "sha256": "2ae4ecdde184f102004b81cca0de0e345278c7ebc2aa0993f5a8ef47acf50e91"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-unreviewed-uses.yml",
+          "sha256": "4e1a4f1d5c7b147af24dac04448617a77649e711366ab19701d6e878a1c0a274"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-unsafe-programs.yml",
+          "sha256": "5c464126d992dc5305ca68c6ebb0f7086650d0e86dc56aee35ee0de40e6b1f96"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject-yaml-structure.yml",
+          "sha256": "e564fe3b6655a68c242038c98f480fe432ed840aa3325caab88e052343352402"
+        },
+        {
+          "path": "scripts/fixtures/public-workflow-policy/reject.yml",
+          "sha256": "e98e5b29312f6541e6d71fc532943a055c9164923cd560710d47414ac80aecc1"
+        },
+        {
+          "path": "scripts/test-check-public-workflow-policy.sh",
+          "sha256": "9b857524e8b736a104e1aa65a3fa5edeaf76a3787ba8942871992675440f550b"
+        }
+      ],
+      "state": "staged"
     }
   ],
   "version": 1
diff --git a/.github/public-workflow-command-allowlist.json b/.github/public-workflow-command-allowlist.json
index 9919f735..4ece4357 100644
--- a/.github/public-workflow-command-allowlist.json
+++ b/.github/public-workflow-command-allowlist.json
@@ -1,196 +1,4 @@
 [
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "$assignment",
-    "statementSHA256": "c0c433693a307a0c5c423fa126f7690084d93243b539c72221d5148dcaa24f09",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed literal assignment for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "$assignment",
-    "statementSHA256": "d9a0185bb46ae5c1ec79645d990431495cf18d3f75cf24ab9d9e15790d1be188",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed literal assignment for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "[",
-    "statementSHA256": "21430cc4ac1193bbb95ec1575f04ae6b65d6ada2b4bca8c4195d288c9bc449bf",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed [ statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "[",
-    "statementSHA256": "d9a0185bb46ae5c1ec79645d990431495cf18d3f75cf24ab9d9e15790d1be188",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed [ statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "awk",
-    "statementSHA256": "d9a0185bb46ae5c1ec79645d990431495cf18d3f75cf24ab9d9e15790d1be188",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed awk statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "benchstat",
-    "statementSHA256": "961fec081cdb44d1e3ef10393cce0840c1f3ec48cc068f492701cf03de6ffed7",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed benchstat statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "break",
-    "statementSHA256": "d9a0185bb46ae5c1ec79645d990431495cf18d3f75cf24ab9d9e15790d1be188",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed break statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "cd",
-    "statementSHA256": "1da8bf23d2c0684c704bbca52edd911233fb4bb267f1118d5b94915af4ce2757",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed cd statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "cp",
-    "statementSHA256": "ecf28d9064234b3ad9daccf68db49f1f91c65c21c2ac8f1dae3c06b65132d9d8",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed cp statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "echo",
-    "statementSHA256": "175ed3056dc0639f05e3a0de9d2616f294cfadefd6089f69cbac1dffbd6490dd",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed echo statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "echo",
-    "statementSHA256": "21430cc4ac1193bbb95ec1575f04ae6b65d6ada2b4bca8c4195d288c9bc449bf",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed echo statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "echo",
-    "statementSHA256": "6ea234c2788bcc4ba388da39084e63ae28c829e83006b91554859019723f2c07",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed echo statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "echo",
-    "statementSHA256": "7041a39bf0738820394b5fc1f03e6d760956bb63942be0a85157550c6987511c",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed echo statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "echo",
-    "statementSHA256": "d9a0185bb46ae5c1ec79645d990431495cf18d3f75cf24ab9d9e15790d1be188",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed echo statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "echo",
-    "statementSHA256": "eedcefe944dfb5c1a4d393497272271bfa8ea66bfb96435c7881d477a4df550d",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed echo statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "exit",
-    "statementSHA256": "1a21be8bb1dc4721d30cc1850ead617faa55ae9aebf416da4369668bdeaf0824",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed exit statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "go",
-    "statementSHA256": "3c1b589932f67a655ff6bfb1741a31b1c9ab4668b3e6b408e4fcf96472c20edb",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed go statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "go",
-    "statementSHA256": "cfd6b00644f2b1a427bf34c2864d1ea1607bc8df4873876e092c2a015f2700bb",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed go statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "grep",
-    "statementSHA256": "d9a0185bb46ae5c1ec79645d990431495cf18d3f75cf24ab9d9e15790d1be188",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed grep statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "npm",
-    "statementSHA256": "1da8bf23d2c0684c704bbca52edd911233fb4bb267f1118d5b94915af4ce2757",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed npm statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "read",
-    "statementSHA256": "d9a0185bb46ae5c1ec79645d990431495cf18d3f75cf24ab9d9e15790d1be188",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed read statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "tail",
-    "statementSHA256": "d9a0185bb46ae5c1ec79645d990431495cf18d3f75cf24ab9d9e15790d1be188",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed tail statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "tee",
-    "statementSHA256": "cfd6b00644f2b1a427bf34c2864d1ea1607bc8df4873876e092c2a015f2700bb",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed tee statement for benchmark.yml automation."
-  },
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "command": "true",
-    "statementSHA256": "961fec081cdb44d1e3ef10393cce0840c1f3ec48cc068f492701cf03de6ffed7",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "rationale": "Exact reviewed true statement for benchmark.yml automation."
-  },
   {
     "path": ".github/workflows/ci.yml",
     "command": "$assignment",
@@ -2436,7 +2244,7 @@
     "command": "cd",
     "statementSHA256": "1da8bf23d2c0684c704bbca52edd911233fb4bb267f1118d5b94915af4ce2757",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2444,7 +2252,7 @@
     "command": "npm",
     "statementSHA256": "1da8bf23d2c0684c704bbca52edd911233fb4bb267f1118d5b94915af4ce2757",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2452,7 +2260,7 @@
     "command": "go",
     "statementSHA256": "3c1b589932f67a655ff6bfb1741a31b1c9ab4668b3e6b408e4fcf96472c20edb",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2460,7 +2268,7 @@
     "command": "go",
     "statementSHA256": "0b169221a14ced8d9e2626373a08ecd6cc5d98b45fb962b73b7c5e8fa649b676",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2468,7 +2276,7 @@
     "command": "go",
     "statementSHA256": "cfd6b00644f2b1a427bf34c2864d1ea1607bc8df4873876e092c2a015f2700bb",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2476,7 +2284,7 @@
     "command": "tee",
     "statementSHA256": "cfd6b00644f2b1a427bf34c2864d1ea1607bc8df4873876e092c2a015f2700bb",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2484,7 +2292,7 @@
     "command": "$assignment",
     "statementSHA256": "6911dc69ba1aa10a01cd1b0563efbb02d008c9e0ffd5c72471177bf8db8f0eec",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2492,7 +2300,7 @@
     "command": "cat",
     "statementSHA256": "6911dc69ba1aa10a01cd1b0563efbb02d008c9e0ffd5c72471177bf8db8f0eec",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2500,7 +2308,7 @@
     "command": "echo",
     "statementSHA256": "e5b7e17a95219aa32ca80405727547a9c29b9780744e115583f6c1a68a224750",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2508,7 +2316,7 @@
     "command": "$assignment",
     "statementSHA256": "ffd4c2588e960687e8be3db328048a0dcb944a9c1426e6afaafafef832109740",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2516,7 +2324,7 @@
     "command": "[",
     "statementSHA256": "50b89f8af205b68cf50a606470fdea48d51311de3bf807c03fe8aca0b92ef7c1",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2524,7 +2332,7 @@
     "command": "$assignment",
     "statementSHA256": "50b89f8af205b68cf50a606470fdea48d51311de3bf807c03fe8aca0b92ef7c1",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2532,7 +2340,7 @@
     "command": "awk",
     "statementSHA256": "dabc56d53c8b4b869174d2673fb6759252ac3f41af4529dd558943edda60a0b7",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2540,7 +2348,7 @@
     "command": "[",
     "statementSHA256": "76af494e770c8a05a29ea83b525a9bed94a4a6fcbaf3ac11de547454b47fed47",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2548,7 +2356,7 @@
     "command": "echo",
     "statementSHA256": "76af494e770c8a05a29ea83b525a9bed94a4a6fcbaf3ac11de547454b47fed47",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2556,7 +2364,7 @@
     "command": "exit",
     "statementSHA256": "76af494e770c8a05a29ea83b525a9bed94a4a6fcbaf3ac11de547454b47fed47",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2564,7 +2372,7 @@
     "command": "echo",
     "statementSHA256": "aa9a819f2f2977ec77ec813b0fa8b8ab2b753db0eb369df762eb7bb9010892a8",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2572,7 +2380,7 @@
     "command": "benchstat",
     "statementSHA256": "92e1f5a57f18999c6b9359e1c7a2d9d39cd8d4c0958759cdfaa32aa2ad8bd09f",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2580,7 +2388,7 @@
     "command": "awk",
     "statementSHA256": "92e1f5a57f18999c6b9359e1c7a2d9d39cd8d4c0958759cdfaa32aa2ad8bd09f",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2588,7 +2396,7 @@
     "command": "exit",
     "statementSHA256": "92e1f5a57f18999c6b9359e1c7a2d9d39cd8d4c0958759cdfaa32aa2ad8bd09f",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2596,7 +2404,7 @@
     "command": "[",
     "statementSHA256": "3dc8c35ff510a0b4eaa921e42db66fa7f2152f40b1f4133300759c176b247f62",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2604,7 +2412,7 @@
     "command": "awk",
     "statementSHA256": "3dc8c35ff510a0b4eaa921e42db66fa7f2152f40b1f4133300759c176b247f62",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2612,7 +2420,7 @@
     "command": "exit",
     "statementSHA256": "3dc8c35ff510a0b4eaa921e42db66fa7f2152f40b1f4133300759c176b247f62",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2620,7 +2428,7 @@
     "command": "awk",
     "statementSHA256": "8c1c7655a9bddd70fe48d0aef7fd3bcb7cd34152622e7355e07f7e042a5d9197",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2628,7 +2436,7 @@
     "command": "echo",
     "statementSHA256": "6ea234c2788bcc4ba388da39084e63ae28c829e83006b91554859019723f2c07",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2636,7 +2444,7 @@
     "command": "cp",
     "statementSHA256": "ecf28d9064234b3ad9daccf68db49f1f91c65c21c2ac8f1dae3c06b65132d9d8",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2644,7 +2452,7 @@
     "command": "echo",
     "statementSHA256": "175ed3056dc0639f05e3a0de9d2616f294cfadefd6089f69cbac1dffbd6490dd",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
@@ -2652,7 +2460,7 @@
     "command": "exit",
     "statementSHA256": "1a21be8bb1dc4721d30cc1850ead617faa55ae9aebf416da4369668bdeaf0824",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "rationale": "Focused frozen benchmark repair command."
   },
   {
diff --git a/.github/public-workflow-presence-allowlist.json b/.github/public-workflow-presence-allowlist.json
index bd45d7c9..852bdd62 100644
--- a/.github/public-workflow-presence-allowlist.json
+++ b/.github/public-workflow-presence-allowlist.json
@@ -1,10 +1,4 @@
 [
-  {
-    "path": ".github/workflows/benchmark.yml",
-    "contextSHA256": "24ff378f17200e8c02f20803633bc56a61c472c86d176bd9d9ca3a001f1fc300",
-    "state": "active",
-    "presence": "present"
-  },
   {
     "path": ".github/workflows/ci.yml",
     "contextSHA256": "532f4356f1104b87bb64c51db920bcf28c9fdceabcacad84d189522a3de014bc",
@@ -114,7 +108,7 @@
   {
     "path": ".github/workflows/benchmark.yml",
     "contextSHA256": "0095a1d437ba5a9b5ddad0c3de98e4c911e9c96bfbdf7ad2e0a0187ef69c24b7",
-    "state": "staged",
+    "state": "active",
     "presence": "present"
   },
   {