diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 000000000..42563fb80
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - rise-gcc-ci
diff --git a/.github/actions/common/download-build-log-artifact/action.yaml b/.github/actions/common/download-build-log-artifact/action.yaml
index d89a8e9b5..916ecb6a1 100644
--- a/.github/actions/common/download-build-log-artifact/action.yaml
+++ b/.github/actions/common/download-build-log-artifact/action.yaml
@@ -8,6 +8,9 @@ inputs:
   output-dir:
     required: true
     description: 'Absolute path to the output directory'
+  repository:
+    required: true
+    description: 'Repository to search when the artifact is not in the current workflow'
 
 runs:
   using: "composite"
@@ -30,5 +33,5 @@ runs:
       run: |
         pip install pygithub requests
         cd riscv-gnu-toolchain
-        python ./scripts/download_artifact.py -name ${{ inputs.build-artifact-name }} -repo patrick-rivos/gcc-postcommit-ci -token ${{ inputs.github-token }} -outdir ${{ inputs.output-dir }}
+        python ./scripts/download_artifact.py -name ${{ inputs.build-artifact-name }} -repo ${{ inputs.repository }} -token ${{ inputs.github-token }} -outdir ${{ inputs.output-dir }}
       continue-on-error: true
diff --git a/.github/actions/common/download-comparison-artifacts/action.yaml b/.github/actions/common/download-comparison-artifacts/action.yaml
index d485a1390..889e0aa1e 100644
--- a/.github/actions/common/download-comparison-artifacts/action.yaml
+++ b/.github/actions/common/download-comparison-artifacts/action.yaml
@@ -7,6 +7,9 @@ inputs:
     required: true
   github-token:
     required: true
+  repository:
+    required: true
+    description: 'Repository to search when the artifact is not in the current workflow'
 
 runs:
   using: "composite"
@@ -30,7 +33,7 @@ runs:
       run: |
         pip install pygithub requests
         cd riscv-gnu-toolchain
-        python ./scripts/download_artifact.py -name ${{ inputs.report-artifact-name }} -repo patrick-rivos/gcc-postcommit-ci -token ${{ inputs.github-token }} -outdir current_logs
+        python ./scripts/download_artifact.py -name ${{ inputs.report-artifact-name }} -repo ${{ inputs.repository }} -token ${{ inputs.github-token }} -outdir current_logs
       continue-on-error: true
 
     - name: Report failed download
@@ -51,9 +54,9 @@ runs:
 
 
     - name: Download binary from another workflow
-      if: ${{ !cancelled() && steps.report-download.outputs.report_download == 'falure' && steps.same-workflow-binary.outcome == 'failure' }}
+      if: ${{ !cancelled() && steps.report-download.outputs.report_download == 'failure' && steps.same-workflow-binary.outcome == 'failure' }}
       shell: bash
       run: |
         cd riscv-gnu-toolchain
-        python ./scripts/download_artifact.py -name ${{ inputs.binary-artifact-name }} -repo patrick-rivos/gcc-postcommit-ci -token ${{ inputs.github-token }} -outdir temp
+        python ./scripts/download_artifact.py -name ${{ inputs.binary-artifact-name }} -repo ${{ inputs.repository }} -token ${{ inputs.github-token }} -outdir temp
       continue-on-error: true
diff --git a/.github/actions/common/init-and-pull-gcc/action.yaml b/.github/actions/common/init-and-pull-gcc/action.yaml
index caa5220b4..20a059f88 100644
--- a/.github/actions/common/init-and-pull-gcc/action.yaml
+++ b/.github/actions/common/init-and-pull-gcc/action.yaml
@@ -70,7 +70,7 @@ runs:
           cd gcc
           git config --add remote.origin.fetch "+refs/vendors/riscv/*:refs/remotes/upstream/vendors/riscv/*"
           git fetch
-          git checkout upstream/vendors/riscv/heads/gcc-14-with-riscv-opts
+          git checkout upstream/vendors/riscv/heads/gcc-15-with-riscv-opts
         continue-on-error: true
 
       - name: Sleep and retry
@@ -83,7 +83,7 @@ runs:
           cd gcc
           git config --add remote.origin.fetch "+refs/vendors/riscv/*:refs/remotes/upstream/vendors/riscv/*"
           git fetch
-          git checkout upstream/vendors/riscv/heads/gcc-14-with-riscv-opts
+          git checkout upstream/vendors/riscv/heads/gcc-15-with-riscv-opts
 
       - name: Checkout release branch
         shell: bash
diff --git a/.github/actions/download-all-build-log-artifacts/action.yaml b/.github/actions/download-all-build-log-artifacts/action.yaml
index 683a83e7e..bb86cf23f 100644
--- a/.github/actions/download-all-build-log-artifacts/action.yaml
+++ b/.github/actions/download-all-build-log-artifacts/action.yaml
@@ -11,6 +11,8 @@ inputs:
   output-dir:
     required: true
     description: 'Absolute Path to the artifact directory'
+  repository:
+    required: true
 
 runs:
   using: "composite"
@@ -27,6 +29,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}linux-rv32gc-ilp32d-${{ inputs.gcchash }}-non-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv64gc non-multilib
       uses: ./.github/actions/common/download-build-log-artifact
@@ -34,6 +37,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}linux-rv64gc-lp64d-${{ inputs.gcchash }}-non-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv32 bitmanip non-multilib
       uses: ./.github/actions/common/download-build-log-artifact
@@ -41,6 +45,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}linux-rv32gc_zba_zbb_zbc_zbs-ilp32d-${{ inputs.gcchash }}-non-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv64 bitmanip non-multilib
       uses: ./.github/actions/common/download-build-log-artifact
@@ -48,6 +53,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}linux-rv64gc_zba_zbb_zbc_zbs-lp64d-${{ inputs.gcchash }}-non-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     # Newlib
 
@@ -57,6 +63,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}newlib-rv32gc-ilp32d-${{ inputs.gcchash }}-non-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib rv64gc non-multilib
       uses: ./.github/actions/common/download-build-log-artifact
@@ -64,6 +71,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}newlib-rv64gc-lp64d-${{ inputs.gcchash }}-non-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib rv32 bitmanip non-multilib
       uses: ./.github/actions/common/download-build-log-artifact
@@ -71,6 +79,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}newlib-rv32gc_zba_zbb_zbc_zbs-ilp32d-${{ inputs.gcchash }}-non-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib rv64 bitmanip non-multilib
       uses: ./.github/actions/common/download-build-log-artifact
@@ -78,6 +87,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}newlib-rv64gc_zba_zbb_zbc_zbs-lp64d-${{ inputs.gcchash }}-non-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     # Multilib
     - name: Download linux multilib
@@ -86,6 +96,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}linux-rv64gcv-lp64d-${{ inputs.gcchash }}-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib multilib
       uses: ./.github/actions/common/download-build-log-artifact
@@ -93,6 +104,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}newlib-rv64gcv-lp64d-${{ inputs.gcchash }}-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib uc multilib
       uses: ./.github/actions/common/download-build-log-artifact
@@ -100,6 +112,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}newlib-rv64imc-lp64d-${{ inputs.gcchash }}-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib uc bitmanip multilib
       uses: ./.github/actions/common/download-build-log-artifact
@@ -107,6 +120,7 @@ runs:
         build-artifact-name: ${{ inputs.prefix }}newlib-rv64imc_zba_zbb_zbc_zbs-lp64d-${{ inputs.gcchash }}-multilib-build-log
         github-token: ${{ inputs.github-token }}
         output-dir: ${{ inputs.output-dir }}
+        repository: ${{ inputs.repository }}
 
     - name: Print downloaded artifacts
       shell: bash
diff --git a/.github/actions/download-all-comparison-artifacts/action.yaml b/.github/actions/download-all-comparison-artifacts/action.yaml
index 15f1c0b9d..125b17200 100644
--- a/.github/actions/download-all-comparison-artifacts/action.yaml
+++ b/.github/actions/download-all-comparison-artifacts/action.yaml
@@ -7,6 +7,8 @@ inputs:
     required: true
   prefix:
     required: false
+  repository:
+    required: true
 
 runs:
   using: "composite"
@@ -19,6 +21,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gc-ilp32d-${{ inputs.gcchash }}-non-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gc-ilp32d-${{ inputs.gcchash }}-non-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv64gc non-multilib
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -26,6 +29,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gc-lp64d-${{ inputs.gcchash }}-non-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gc-lp64d-${{ inputs.gcchash }}-non-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv32 bitmanip non-multilib
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -33,6 +37,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gc_zba_zbb_zbc_zbs-ilp32d-${{ inputs.gcchash }}-non-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gc_zba_zbb_zbc_zbs-ilp32d-${{ inputs.gcchash }}-non-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv64 bitmanip non-multilib
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -40,6 +45,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gc_zba_zbb_zbc_zbs-lp64d-${{ inputs.gcchash }}-non-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gc_zba_zbb_zbc_zbs-lp64d-${{ inputs.gcchash }}-non-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     # Newlib
 
@@ -49,6 +55,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv32gc-ilp32d-${{ inputs.gcchash }}-non-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv32gc-ilp32d-${{ inputs.gcchash }}-non-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib rv64gc non-multilib
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -56,6 +63,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64gc-lp64d-${{ inputs.gcchash }}-non-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64gc-lp64d-${{ inputs.gcchash }}-non-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib rv32 bitmanip non-multilib
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -63,6 +71,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv32gc_zba_zbb_zbc_zbs-ilp32d-${{ inputs.gcchash }}-non-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv32gc_zba_zbb_zbc_zbs-ilp32d-${{ inputs.gcchash }}-non-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib rv64 bitmanip non-multilib
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -70,6 +79,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64gc_zba_zbb_zbc_zbs-lp64d-${{ inputs.gcchash }}-non-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64gc_zba_zbb_zbc_zbs-lp64d-${{ inputs.gcchash }}-non-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     # Multilib
     - name: Download linux multilib
@@ -78,6 +88,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib multilib
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -85,6 +96,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64gcv-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64gcv-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib uc multilib
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -92,6 +104,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64imc-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64imc-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib uc bitmanip multilib
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -99,3 +112,4 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64imc_zba_zbb_zbc_zbs-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64imc_zba_zbb_zbc_zbs-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
diff --git a/.github/actions/download-all-weekly-artifacts/action.yaml b/.github/actions/download-all-weekly-artifacts/action.yaml
index ea28dcc7e..5516f1186 100644
--- a/.github/actions/download-all-weekly-artifacts/action.yaml
+++ b/.github/actions/download-all-weekly-artifacts/action.yaml
@@ -7,6 +7,8 @@ inputs:
     required: true
   prefix:
     required: false
+  repository:
+    required: true
 
 runs:
   using: "composite"
@@ -20,6 +22,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gcv_zve64d-ilp32d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gcv_zve64d-ilp32d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv64 zve64d
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -28,6 +31,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zve64d-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zve64d-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     # Download rv64 zvl builds.
 
@@ -38,6 +42,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zvl1024b-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zvl1024b-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv64-512b
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -46,6 +51,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zvl512b-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zvl512b-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv64-256b
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -54,6 +60,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zvl256b-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zvl256b-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     # only have 128b for lmul2 runs
     - name: Download linux rv64-128b
@@ -63,6 +70,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zvl128b-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zvl128b-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     # Download rv32 zvl builds.
 
@@ -73,6 +81,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gcv_zvl1024b-ilp32d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gcv_zvl1024b-ilp32d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv32-512b
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -81,6 +90,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gcv_zvl512b-ilp32d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gcv_zvl512b-ilp32d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv32-256b
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -89,6 +99,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gcv_zvl256b-ilp32d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gcv_zvl256b-ilp32d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     # Download rv32/64 binutils builds.
 
@@ -99,6 +110,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gc-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gc-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download linux rv32-binutils
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -107,6 +119,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gc-ilp32d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv32gc-ilp32d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib rv64-binutils
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -115,6 +128,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64gc-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv64gc-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     - name: Download newlib rv32-binutils
       uses: ./.github/actions/common/download-comparison-artifacts
@@ -123,6 +137,7 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv32gc-ilp32d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-newlib-rv32gc-ilp32d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
 
     # Download with checking builds
 
@@ -133,3 +148,4 @@ runs:
         report-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zicond-lp64d-${{ inputs.gcchash }}-multilib-report.log
         binary-artifact-name: ${{ inputs.prefix }}gcc-linux-rv64gcv_zicond-lp64d-${{ inputs.gcchash }}-multilib
         github-token: ${{ inputs.token }}
+        repository: ${{ inputs.repository }}
diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index 2def8f6c7..faa11de02 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -23,7 +23,7 @@ on:
         type: string
       run_on_self_hosted:
         required: true
-        type: string
+        type: boolean
       prefix:
         required: false
         type: string
@@ -50,7 +50,7 @@ jobs:
       run:
         working-directory: riscv-gnu-toolchain
     needs: [check]
-    if: ${{ needs.check.outputs.early_exit != 'exit' && inputs.run_on_self_hosted != 'true' }}
+    if: ${{ needs.check.outputs.early_exit != 'exit' && !inputs.run_on_self_hosted }}
     steps:
       - uses: actions/checkout@v4
 
@@ -99,7 +99,7 @@ jobs:
           prefix: ${{ inputs.prefix }}
 
     outputs:
-      build_success: ${{ steps.build-status.outputs.build_success }}
+      build_success: ${{ steps.build-status.outputs.build_status }}
 
   test:
     runs-on: ubuntu-24.04
@@ -109,7 +109,7 @@ jobs:
         working-directory: riscv-gnu-toolchain
     needs: [check, build]
     # Skip linux multilib
-    if: ${{ needs.check.outputs.early_exit != 'exit' && inputs.run_on_self_hosted != 'true' }}
+    if: ${{ needs.check.outputs.early_exit != 'exit' && !inputs.run_on_self_hosted }}
     steps:
       - uses: actions/checkout@v4
 
@@ -171,13 +171,13 @@ jobs:
   # We need to rebuild since restoring the artifact won't work
   # (the new path will break the existing build).
   rerun-timeouts:
-    runs-on: self-hosted
+    runs-on: [self-hosted, linux, x64, rise-gcc-ci]
     environment: production
     defaults:
       run:
         working-directory: riscv-gnu-toolchain
     needs: [check, build, test]
-    if: ${{ failure() && needs.build.outputs.build_success == 'success' && inputs.run_on_self_hosted != 'true' }}
+    if: ${{ failure() && needs.build.outputs.build_success == 'success' && !inputs.run_on_self_hosted }}
     timeout-minutes: 1440 # 24 hours
     steps:
       - name: 'Cleanup build folder'
@@ -247,13 +247,13 @@ jobs:
   # We need to rebuild since restoring the artifact won't work
   # (the new path will break the existing build).
   run-on-self-hosted:
-    runs-on: self-hosted
+    runs-on: [self-hosted, linux, x64, rise-gcc-ci]
     environment: production
     defaults:
       run:
         working-directory: riscv-gnu-toolchain
     needs: [check]
-    if: ${{ needs.check.outputs.early_exit != 'exit' && inputs.run_on_self_hosted == 'true' }}
+    if: ${{ needs.check.outputs.early_exit != 'exit' && inputs.run_on_self_hosted }}
     timeout-minutes: 1440 # 24 hours
     steps:
       - name: 'Cleanup build folder'
diff --git a/.github/workflows/build-with-checking.yaml b/.github/workflows/build-with-checking.yaml
index 43439465f..a69a76ede 100644
--- a/.github/workflows/build-with-checking.yaml
+++ b/.github/workflows/build-with-checking.yaml
@@ -14,6 +14,9 @@ on:
       gcchash:
         required: true
         type: string
+      multilib:
+        required: true
+        type: string
       multitarget:
         required: false
         type: string
diff --git a/.github/workflows/deploy-dashboard.yaml b/.github/workflows/deploy-dashboard.yaml
index c97b8e9fe..2eb0508eb 100644
--- a/.github/workflows/deploy-dashboard.yaml
+++ b/.github/workflows/deploy-dashboard.yaml
@@ -9,6 +9,9 @@ on:
     - cron: 0 0,8,16 * * *
   workflow_dispatch:
 
+env:
+  POSTCOMMIT_REPOSITORY: ${{ github.repository }}
+
 # Serialize dashboard deployments on the same ref to reduce auto-commit push races.
 # Dashboard-only auto-commits are ignored by the push trigger below, so they do not
 # immediately retrigger this workflow.
@@ -23,7 +26,9 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-24.04
     permissions:
+      actions: read
       contents: write
+      issues: read
       pages: write
       id-token: write
     steps:
@@ -40,8 +45,6 @@ jobs:
         run: |
           cd riscv-gnu-toolchain
           git submodule update --init gcc
-          git fetch
-          git reset --hard origin/build-frequent
           cd gcc
           git fetch
         continue-on-error: true
@@ -52,8 +55,6 @@ jobs:
           echo "Failed to initialize gcc. Retrying in 1 min"
           sleep 60
           cd riscv-gnu-toolchain
-          git fetch
-          git reset --hard origin/build-frequent
           git submodule update --init gcc
           cd gcc
           git fetch
@@ -69,7 +70,7 @@ jobs:
         run: |
           pip install pygithub requests
           cd dashboard
-          python getdata.py -token ${{ secrets.GITHUB_TOKEN }}
+          python getdata.py -token ${{ secrets.GITHUB_TOKEN }} -repo "${POSTCOMMIT_REPOSITORY}"
 
       - name: Build site
         run: |
diff --git a/.github/workflows/generate-summary.yaml b/.github/workflows/generate-summary.yaml
index a525fe853..df34eb52f 100644
--- a/.github/workflows/generate-summary.yaml
+++ b/.github/workflows/generate-summary.yaml
@@ -26,8 +26,6 @@ on:
         required: false
         type: string
   workflow_dispatch:
-    branches:
-      - main
     inputs:
       gcchash:
         description: 'GCC Hash'
@@ -41,18 +39,8 @@ on:
       prefix:
         required: false
         description: 'Prefix (Optional)'
-        type: choice
+        type: string
         default: ""
-        options:
-          - ""
-          - "binutils_"
-          - "checking_"
-          - "coord_"
-          - "release_15_"
-          - "release_16_"
-          - "rv32_zvl_"
-          - "rv64_zvl_"
-          - "zve_"
       gcc_branch:
         description: 'GCC branch'
         default: 'master'
@@ -69,13 +57,16 @@ on:
         options:
           - 'master'
 
+env:
+  POSTCOMMIT_REPOSITORY: ${{ github.repository }}
+
 jobs:
   check-early-exit:
     if: always()
     runs-on: ubuntu-24.04
     environment: production
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Check name
         id: check-issue-name
@@ -89,21 +80,22 @@ jobs:
       - name: Check duplicate issue
         id: check-duplicate-issue
         if: ${{ github.event_name == 'schedule' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           ISSUE_NAME='${{ inputs.issue_hash_prefix }} ${{ inputs.gcchash }}'
-          curl -L \
-            -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Token ${{ secrets.GITHUB_TOKEN }}" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            https://api.github.com/repos/patrick-rivos/gcc-postcommit-ci/issues \
-            -o issues.txt
-          FOUND_ISSUE=$(cat issues.txt | jq "map(select(.title == \"$ISSUE_NAME\"))" | tr '\n' ' ' | tr -d [:space:])
-          # if no issue of that name is found, jq returns '[]'
-          echo "found_issue=$FOUND_ISSUE" >> $GITHUB_OUTPUT
+          gh api --paginate \
+            "repos/${POSTCOMMIT_REPOSITORY}/issues?state=open&per_page=100" \
+            --jq '.[].title' > issue_titles.txt
+          if grep -Fqx -- "$ISSUE_NAME" issue_titles.txt; then
+            echo "found_issue=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "found_issue=false" >> "$GITHUB_OUTPUT"
+          fi
 
       - name: Check early exit
         id: early-exit
-        if: ${{ steps.check-issue-name.outputs.bad_name == 'true' || (steps.check-duplicate-issue.outcome != 'skipped' && steps.check-duplicate-issue.outputs.found_issue != '[]') }}
+        if: ${{ steps.check-issue-name.outputs.bad_name == 'true' || steps.check-duplicate-issue.outputs.found_issue == 'true' }}
         run: |
           echo "early_exit=true" >> $GITHUB_OUTPUT
 
@@ -206,6 +198,7 @@ jobs:
           gcchash: ${{ inputs.gcchash }}
           token: ${{ secrets.GITHUB_TOKEN }}
           prefix: ${{ inputs.prefix }}
+          repository: ${{ env.POSTCOMMIT_REPOSITORY }}
 
       - name: Download All targets
         uses: ./.github/actions/download-all-weekly-artifacts
@@ -214,6 +207,7 @@ jobs:
           gcchash: ${{ inputs.gcchash }}
           token: ${{ secrets.GITHUB_TOKEN }}
           prefix: ${{ inputs.prefix }}
+          repository: ${{ env.POSTCOMMIT_REPOSITORY }}
 
       - name: Print API usage info
         run: |
@@ -248,7 +242,7 @@ jobs:
       - name: Download artifacts
         run: |
           pip install pygithub requests
-          python ./scripts/download_artifacts.py -hash ${{ inputs.gcchash }} -repo patrick-rivos/gcc-postcommit-ci -token ${{ secrets.GITHUB_TOKEN }} -prefix "${{ inputs.prefix }}" -build-logs -build-logs-dir ${{ steps.build-log-setup.outputs.previous_build_log_zips_path }}
+          python ./scripts/download_artifacts.py -hash ${{ inputs.gcchash }} -repo "${POSTCOMMIT_REPOSITORY}" -token ${{ secrets.GITHUB_TOKEN }} -prefix "${{ inputs.prefix }}" -build-logs -build-logs-dir ${{ steps.build-log-setup.outputs.previous_build_log_zips_path }}
           ls previous_logs
           if [ -d "${{ steps.build-log-setup.outputs.previous_build_log_zips_path }}" ]; then
             ls ${{ steps.build-log-setup.outputs.previous_build_log_zips_path }}
@@ -268,6 +262,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           prefix: ${{ inputs.prefix }}
           output-dir: ${{ steps.build-log-setup.outputs.current_build_log_zips_path }}
+          repository: ${{ env.POSTCOMMIT_REPOSITORY }}
 
       - name: Unzip current build log artifacts
         uses: ./.github/actions/common/unzip-all-zips
@@ -338,6 +333,8 @@ jobs:
     needs: [check-early-exit, compare-artifacts]
     runs-on: ubuntu-24.04
     permissions:
+      actions: read
+      contents: read
       issues: write
     defaults:
       run:
@@ -404,7 +401,9 @@ jobs:
           IFS=',' read -r -a labels <<< $ISSUE_LABELS
           for label in "${labels[@]}"
           do
-            if [[ "$label" == "build-failure" ]] || [[ "$label" == "testsuite-failure" ]];
+            if [[ "$label" == "build-failure" ]] || \
+               [[ "$label" == "testsuite-failure" ]] || \
+               [[ "$label" == "invalid" ]];
             then
               echo "valid_baseline=false" >> $GITHUB_OUTPUT
               break
@@ -441,7 +440,7 @@ jobs:
               printf "\nThe file was greater than 1 MB and has been trimmed to fit the Gist limit. Please check logs for the untrimmed issue." >> trimmed_issue_gist.md
             fi
           fi
-          run_id=${{ github.run_id }} && echo "Associated run is: https://github.com/patrick-rivos/gcc-postcommit-ci/actions/runs/$run_id" >> trimmed_issue.md
+          run_id=${{ github.run_id }} && echo "Associated run is: ${{ github.server_url }}/${{ github.repository }}/actions/runs/$run_id" >> trimmed_issue.md
           cat trimmed_issue.md
 
       - name: Create Issue Gist
@@ -612,7 +611,7 @@ jobs:
 
       # Adds comment which links issue to PR
       - name: Link Staging PR
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         if: ${{ github.workflow == 'Staging' && github.event.pull_request }}
         with:
           script: |
@@ -645,7 +644,7 @@ jobs:
           fi
 
       - name: Add all the labels to New Issue
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         if: ${{ !cancelled() && steps.labels-upload-setup.outputs.labels_created == 'true' }}
         with:
           script: |
@@ -663,6 +662,8 @@ jobs:
   regenerate-issues:
     runs-on: ubuntu-24.04
     permissions:
+      actions: read
+      contents: read
       issues: write
     defaults:
       run:
@@ -801,6 +802,7 @@ jobs:
           gcchash: ${{ steps.bisection-hash.outputs.orig_gcchash }}
           token: ${{ secrets.GITHUB_TOKEN }}
           prefix: ${{ inputs.prefix }}
+          repository: ${{ env.POSTCOMMIT_REPOSITORY }}
 
       - name: Download All targets
         uses: ./.github/actions/download-all-weekly-artifacts
@@ -809,6 +811,7 @@ jobs:
           gcchash: ${{ steps.bisection-hash.outputs.orig_gcchash }}
           token: ${{ secrets.GITHUB_TOKEN }}
           prefix: ${{ inputs.prefix }}
+          repository: ${{ env.POSTCOMMIT_REPOSITORY }}
 
       - name: Print API usage info
         run: |
@@ -827,7 +830,7 @@ jobs:
       - name: Download artifacts
         run: |
           pip install pygithub requests
-          python ./scripts/download_artifacts.py -hash ${{ steps.bisection-hash.outputs.orig_gcchash }} -repo patrick-rivos/gcc-postcommit-ci -token ${{ secrets.GITHUB_TOKEN }} -prefix "${{ inputs.prefix }}"
+          python ./scripts/download_artifacts.py -hash ${{ steps.bisection-hash.outputs.orig_gcchash }} -repo "${POSTCOMMIT_REPOSITORY}" -token ${{ secrets.GITHUB_TOKEN }} -prefix "${{ inputs.prefix }}"
           ls previous_logs
 
       - name: Compare artifacts
@@ -883,7 +886,7 @@ jobs:
         run: |
           head -c 65000 issue.md > trimmed_issue.md
           if [ $(cat trimmed_issue.md | wc -l) -ne $(cat issue.md | wc -l) ]; then printf "\n\`\`\`\nIssue text has been trimmed. Please check logs for the untrimmed issue.\n" >> trimmed_issue.md; fi
-          run_id=${{ github.run_id }} && echo "Associated run is: https://github.com/patrick-rivos/gcc-postcommit-ci/actions/runs/$run_id" >> trimmed_issue.md
+          run_id=${{ github.run_id }} && echo "Associated run is: ${{ github.server_url }}/${{ github.repository }}/actions/runs/$run_id" >> trimmed_issue.md
           cat trimmed_issue.md
 
       # Leave this for now since peter-evans doesn't have a good way
diff --git a/.github/workflows/pre-pull-request.yaml b/.github/workflows/pre-pull-request.yaml
index 0c1bce086..58154e960 100644
--- a/.github/workflows/pre-pull-request.yaml
+++ b/.github/workflows/pre-pull-request.yaml
@@ -12,7 +12,7 @@ jobs:
   tests:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -24,5 +24,13 @@ jobs:
         run: |
           pip install -r requirements.txt
 
+      - name: Check migration ownership guard
+        run: |
+          python scripts/check_migration_guards.py
+
+      - name: Test dashboard issue ingestion
+        run: |
+          python -m unittest discover -s dashboard/tests -v
+
       - name: Run pre-commit
         uses: pre-commit/action@v3.0.1
diff --git a/.github/workflows/run-daily-rv-gc-binutils.yaml b/.github/workflows/run-daily-rv-gc-binutils.yaml
index 18467c23a..527865c4d 100644
--- a/.github/workflows/run-daily-rv-gc-binutils.yaml
+++ b/.github/workflows/run-daily-rv-gc-binutils.yaml
@@ -7,8 +7,15 @@ on:
     # Run at 5:00am
     - cron: 0 5 * * *
   workflow_dispatch:
-    branches:
-      - main
+    inputs:
+      multi_target:
+        description: 'Only run the selected mode:target pairs (Optional)'
+        required: false
+        type: string
+      issue_num:
+        description: 'Issue number of baseline (Optional)'
+        required: false
+        type: string
 
 jobs:
   # init-submodules sees "binutils_" and lies to us, giving us the binutils hash instead of the gcc hash.
@@ -49,6 +56,8 @@ jobs:
     if: "!cancelled()" # Generate github issues even when some (or all) targets fail to build
     needs: [init-submodules, binutils-self-hosted]
     permissions:
+      actions: read
+      contents: read
       issues: write
     uses: ./.github/workflows/generate-summary.yaml
     secrets: inherit
diff --git a/.github/workflows/run-frequent-15.yaml b/.github/workflows/run-frequent-15.yaml
index a0e047d1a..c28ee9a4a 100644
--- a/.github/workflows/run-frequent-15.yaml
+++ b/.github/workflows/run-frequent-15.yaml
@@ -17,8 +17,6 @@ on:
         required: true
         type: string
   workflow_dispatch:
-    branches:
-      - main
     inputs:
       gcchash:
         description: 'GCC Hash'
@@ -112,8 +110,11 @@ jobs:
     if: "!cancelled()" # Generate github issues even when some (or all) targets fail to build
     needs: [init-submodules, creg, cmreg-self-hosted, cmreg-self-hosted-uc]
     permissions:
+      actions: read
+      contents: read
       issues: write
     uses: ./.github/workflows/generate-summary.yaml
+    secrets: inherit
     with:
       gcchash: ${{ needs.init-submodules.outputs.gcchash }}
       issue_num: ${{ inputs.issue_num }}
diff --git a/.github/workflows/run-frequent-16.yaml b/.github/workflows/run-frequent-16.yaml
index dc37a317d..e997160da 100644
--- a/.github/workflows/run-frequent-16.yaml
+++ b/.github/workflows/run-frequent-16.yaml
@@ -17,8 +17,6 @@ on:
         required: true
         type: string
   workflow_dispatch:
-    branches:
-      - main
     inputs:
       gcchash:
         description: 'GCC Hash'
@@ -112,8 +110,11 @@ jobs:
     if: "!cancelled()" # Generate github issues even when some (or all) targets fail to build
     needs: [init-submodules, creg, cmreg-self-hosted, cmreg-self-hosted-uc]
     permissions:
+      actions: read
+      contents: read
       issues: write
     uses: ./.github/workflows/generate-summary.yaml
+    secrets: inherit
     with:
       gcchash: ${{ needs.init-submodules.outputs.gcchash }}
       issue_num: ${{ inputs.issue_num }}
diff --git a/.github/workflows/run-frequent-coordination.yaml b/.github/workflows/run-frequent-coordination.yaml
index def11f5fb..037ee9cdb 100644
--- a/.github/workflows/run-frequent-coordination.yaml
+++ b/.github/workflows/run-frequent-coordination.yaml
@@ -17,8 +17,6 @@ on:
         required: true
         type: string
   workflow_dispatch:
-    branches:
-      - main
     inputs:
       gcchash:
         description: 'GCC Hash'
@@ -112,6 +110,8 @@ jobs:
     if: "!cancelled()" # Generate github issues even when some (or all) targets fail to build
     needs: [init-submodules, creg, cmreg-self-hosted, cmreg-self-hosted-uc]
     permissions:
+      actions: read
+      contents: read
       issues: write
     uses: ./.github/workflows/generate-summary.yaml
     secrets: inherit
diff --git a/.github/workflows/run-frequent.yaml b/.github/workflows/run-frequent.yaml
index 91cadeeff..9c0ba89d7 100644
--- a/.github/workflows/run-frequent.yaml
+++ b/.github/workflows/run-frequent.yaml
@@ -22,8 +22,6 @@ on:
         required: true
         type: string
   workflow_dispatch:
-    branches:
-      - main
     inputs:
       gcchash:
         description: 'GCC Hash'
@@ -117,6 +115,8 @@ jobs:
     if: "!cancelled()" # Generate github issues even when some (or all) targets fail to build
     needs: [init-submodules, creg, cmreg-self-hosted, cmreg-self-hosted-uc]
     permissions:
+      actions: read
+      contents: read
       issues: write
     uses: ./.github/workflows/generate-summary.yaml
     secrets: inherit
diff --git a/.github/workflows/run-weekly-gcv-zve.yaml b/.github/workflows/run-weekly-gcv-zve.yaml
index 616673be3..7daaca512 100644
--- a/.github/workflows/run-weekly-gcv-zve.yaml
+++ b/.github/workflows/run-weekly-gcv-zve.yaml
@@ -7,8 +7,15 @@ on:
     # Run at 4:00pm on Sundays
     - cron: 0 16 * * 0
   workflow_dispatch:
-    branches:
-      - main
+    inputs:
+      multi_target:
+        description: 'Only run the selected mode:target pairs (Optional)'
+        required: false
+        type: string
+      issue_num:
+        description: 'Issue number of baseline (Optional)'
+        required: false
+        type: string
 
 jobs:
   init-submodules:
@@ -47,8 +54,11 @@ jobs:
     if: "!cancelled()" # Generate github issues even when some (or all) targets fail to build
     needs: [init-submodules, zvl-variants-self-hosted]
     permissions:
+      actions: read
+      contents: read
       issues: write
     uses: ./.github/workflows/generate-summary.yaml
+    secrets: inherit
     with:
       gcchash: ${{ needs.init-submodules.outputs.gcchash }}
       issue_num: ${{ github.event.inputs.issue_num }}
diff --git a/.github/workflows/run-weekly-rv32gcv-zvl.yaml b/.github/workflows/run-weekly-rv32gcv-zvl.yaml
index 6116030ee..444fa617e 100644
--- a/.github/workflows/run-weekly-rv32gcv-zvl.yaml
+++ b/.github/workflows/run-weekly-rv32gcv-zvl.yaml
@@ -7,8 +7,15 @@ on:
     # Run at 4:00pm on Mondays
     - cron: 0 16 * * 1
   workflow_dispatch:
-    branches:
-      - main
+    inputs:
+      multi_target:
+        description: 'Only run the selected mode:target pairs (Optional)'
+        required: false
+        type: string
+      issue_num:
+        description: 'Issue number of baseline (Optional)'
+        required: false
+        type: string
 
 jobs:
   init-submodules:
@@ -46,6 +53,8 @@ jobs:
     if: "!cancelled()" # Generate github issues even when some (or all) targets fail to build
     needs: [init-submodules, zvl-variants-self-hosted]
     permissions:
+      actions: read
+      contents: read
       issues: write
     uses: ./.github/workflows/generate-summary.yaml
     secrets: inherit
diff --git a/.github/workflows/run-weekly-rv64gcv-zvl-lmul2.yaml b/.github/workflows/run-weekly-rv64gcv-zvl-lmul2.yaml
index b1d43cd01..f42c49c8d 100644
--- a/.github/workflows/run-weekly-rv64gcv-zvl-lmul2.yaml
+++ b/.github/workflows/run-weekly-rv64gcv-zvl-lmul2.yaml
@@ -7,8 +7,15 @@ on:
     # Run at 4:00pm on Tuesdays
     - cron: 0 16 * * 2
   workflow_dispatch:
-    branches:
-      - main
+    inputs:
+      multi_target:
+        description: 'Only run the selected mode:target pairs (Optional)'
+        required: false
+        type: string
+      issue_num:
+        description: 'Issue number of baseline (Optional)'
+        required: false
+        type: string
 
 jobs:
   init-submodules:
@@ -47,8 +54,11 @@ jobs:
     if: "!cancelled()" # Generate github issues even when some (or all) targets fail to build
     needs: [init-submodules, zvl-variants-self-hosted]
     permissions:
+      actions: read
+      contents: read
       issues: write
     uses: ./.github/workflows/generate-summary.yaml
+    secrets: inherit
     with:
       gcchash: ${{ needs.init-submodules.outputs.gcchash }}
       issue_num: ${{ github.event.inputs.issue_num }}
diff --git a/.github/workflows/run-weekly-rv64gcv-zvl.yaml b/.github/workflows/run-weekly-rv64gcv-zvl.yaml
index 72e1624e1..e20411c74 100644
--- a/.github/workflows/run-weekly-rv64gcv-zvl.yaml
+++ b/.github/workflows/run-weekly-rv64gcv-zvl.yaml
@@ -7,8 +7,15 @@ on:
     # Run at 4:00pm on Wednesdays
     - cron: 0 16 * * 3
   workflow_dispatch:
-    branches:
-      - main
+    inputs:
+      multi_target:
+        description: 'Only run the selected mode:target pairs (Optional)'
+        required: false
+        type: string
+      issue_num:
+        description: 'Issue number of baseline (Optional)'
+        required: false
+        type: string
 
 jobs:
   init-submodules:
@@ -46,6 +53,8 @@ jobs:
     if: "!cancelled()" # Generate github issues even when some (or all) targets fail to build
     needs: [init-submodules, zvl-variants-self-hosted]
     permissions:
+      actions: read
+      contents: read
       issues: write
     uses: ./.github/workflows/generate-summary.yaml
     secrets: inherit
diff --git a/.github/workflows/run-weekly-with-checking.yaml b/.github/workflows/run-weekly-with-checking.yaml
index 53f63da47..537b77725 100644
--- a/.github/workflows/run-weekly-with-checking.yaml
+++ b/.github/workflows/run-weekly-with-checking.yaml
@@ -7,8 +7,15 @@ on:
     # Run at 4:00pm on Saturdays
     - cron: 0 16 * * 6
   workflow_dispatch:
-    branches:
-      - main
+    inputs:
+      multi_target:
+        description: 'Only run the selected mode:target pairs (Optional)'
+        required: false
+        type: string
+      issue_num:
+        description: 'Issue number of baseline (Optional)'
+        required: false
+        type: string
 
 jobs:
   init-submodules:
@@ -44,6 +51,8 @@ jobs:
     if: "!cancelled()" # Generate github issues even when some (or all) targets fail to build
     needs: [init-submodules, checking-variants-self-hosted]
     permissions:
+      actions: read
+      contents: read
       issues: write
     uses: ./.github/workflows/generate-summary.yaml
     secrets: inherit
diff --git a/.github/workflows/run-weekly.yaml b/.github/workflows/run-weekly.yaml
index 86af85940..501ee35e5 100644
--- a/.github/workflows/run-weekly.yaml
+++ b/.github/workflows/run-weekly.yaml
@@ -10,8 +10,11 @@ on:
     # Run at 10:32am on Saturdays
     - cron: 32 10 * * 6
   workflow_dispatch:
-    branches:
-      - main
+    inputs:
+      multi_target:
+        description: 'Only run the selected mode:target pairs (Optional)'
+        required: false
+        type: string
 
 jobs:
   init-submodules:
@@ -40,6 +43,7 @@ jobs:
       mode: ${{ matrix.mode }}
       target: ${{ matrix.target }}
       gcchash: ${{ needs.init-submodules.outputs.gcchash }}
+      multilib: 'multilib'
       multitarget: ${{ github.event.inputs.multi_target }}
 
   rvv-intrinsic-testing:
diff --git a/.github/workflows/rvv-intrinsic-test.yaml b/.github/workflows/rvv-intrinsic-test.yaml
index eef4461a7..4dfecae56 100644
--- a/.github/workflows/rvv-intrinsic-test.yaml
+++ b/.github/workflows/rvv-intrinsic-test.yaml
@@ -9,7 +9,7 @@ on:
 
 jobs:
   rvv-intrinsic-testing:
-    runs-on: self-hosted
+    runs-on: [self-hosted, linux, x64, rise-gcc-ci]
     environment: production
     steps:
       - name: 'Cleanup build folder'
@@ -57,7 +57,7 @@ jobs:
         continue-on-error: true
 
       - name: Clone rvv-intrinsic-doc
-        if: ${{ steps.update-intrinsice.outcome == 'failure' }}
+        if: ${{ steps.update-intrinsic.outcome == 'failure' }}
         run: |
           echo "Failed to update intrinsic doc. Retrying in 1 min"
           sleep 60
diff --git a/.github/workflows/staging.yaml b/.github/workflows/staging.yaml
index ae4fc66ee..fbea57d93 100644
--- a/.github/workflows/staging.yaml
+++ b/.github/workflows/staging.yaml
@@ -9,8 +9,6 @@ on:
     branches:
       - main
   workflow_dispatch:
-    branches:
-      - main
     inputs:
       gcchash:
         description: 'GCC Hash'
@@ -19,15 +17,21 @@ on:
         description: 'Bisection Issue Number (Optional)'
         required: false
 
+env:
+  POSTCOMMIT_REPOSITORY: ${{ github.repository }}
+
 jobs:
   manually-triggered-workflow-dispatch:
     uses: ./.github/workflows/run-frequent.yaml
     if: ${{ inputs.gcchash != '' }}
     permissions:
+      actions: read
+      contents: read
       issues: write
     with:
       gcchash: ${{ inputs.gcchash }}
       issue_num: ${{ inputs.issue_num }}
+    secrets: inherit
 
   get-hash:
     runs-on: ubuntu-24.04
@@ -52,7 +56,7 @@ jobs:
         id: baseline-hash
         run: |
           cd riscv-gnu-toolchain
-          python ./scripts/get_staging_hash.py -token ${{ secrets.GITHUB_TOKEN }} -repo patrick-rivos/gcc-postcommit-ci
+          python ./scripts/get_staging_hash.py -token ${{ secrets.GITHUB_TOKEN }} -repo "${POSTCOMMIT_REPOSITORY}"
           BASELINE_HASH=$(cat issue_hash.txt)
           echo "baseline_hash=$BASELINE_HASH" >> $GITHUB_OUTPUT
 
@@ -70,8 +74,10 @@ jobs:
   run-workflow:
     needs: [get-hash]
     uses: ./.github/workflows/run-frequent.yaml
-    if: ${{ inputs.gcchash == '' }}
+    if: ${{ inputs.gcchash == '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
     permissions:
+      actions: read
+      contents: read
       issues: write
     secrets: inherit
     with:
diff --git a/.gitmodules b/.gitmodules
index 3358d5d05..da4e7eebd 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,6 +1,7 @@
 [submodule "riscv-gnu-toolchain"]
 	path = riscv-gnu-toolchain
-	url = https://github.com/patrick-rivos/riscv-gnu-toolchain.git
+	url = https://github.com/riseproject-dev/riscv-gnu-toolchain-ci.git
+	branch = build-frequent
 [submodule "rvv-intrinsic-doc"]
 	path = rvv-intrinsic-doc
 	url = https://github.com/riscv-non-isa/rvv-intrinsic-doc.git
diff --git a/README.md b/README.md
index 1ac76aae7..b5855cb3a 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,10 @@
 # GCC Postcommit CI
 
-This repo runs the GCC testsuite on a variety of risc-v targets.
+This RISE-maintained service runs the GCC testsuite on a variety of RISC-V
+targets. Deployment and ownership requirements are documented in
+[`docs/rise-postcommit-cutover.md`](docs/rise-postcommit-cutover.md); regression
+triage is documented in
+[`docs/postcommit-maintenance-runbook.md`](docs/postcommit-maintenance-runbook.md).
 
 # Dashboards
 - [Main](https://riseproject-dev.github.io/gcc-postcommit-ci/)
diff --git a/dashboard/getdata.py b/dashboard/getdata.py
index 4c59f1d3c..24f3d3325 100644
--- a/dashboard/getdata.py
+++ b/dashboard/getdata.py
@@ -1,10 +1,10 @@
 import argparse
 import contextlib
-import shutil
 import os
+import re
+import shutil
 from typing import Dict, List, Set
 from zipfile import ZipFile
-import json
 import requests
 from compare_testsuite_log import (
     Description,
@@ -14,6 +14,23 @@
 from download_artifact import search_for_artifact, download_artifact, extract_artifact
 
 
+DEFAULT_POSTCOMMIT_REPOSITORY = os.environ.get(
+    "POSTCOMMIT_REPOSITORY", "riseproject-dev/gcc-postcommit-ci"
+)
+DASHBOARD_STATUS_TITLES = (
+    "Testsuite Status",
+    "Testsuite zve Status",
+    "Testsuite rv32gcv-zvl Status",
+    "Testsuite rv64gcv-zvl Status",
+    "Testsuite rv64gcv-zvl lmul2 Status",
+    "Testsuite with checking Status",
+)
+STATUS_ISSUE_PATTERN = re.compile(
+    rf"^(?:{'|'.join(re.escape(title) for title in DASHBOARD_STATUS_TITLES)}) "
+    r"([0-9a-f]{40})$"
+)
+
+
 def parse_arguments():
     """parse command line arguments"""
     parser = argparse.ArgumentParser(description="Get issue information")
@@ -28,26 +45,53 @@ def parse_arguments():
         action="store_true",
         help="Build the current_logs from scratch. Takes a long time.",
     )
+    parser.add_argument(
+        "-repo",
+        default=DEFAULT_POSTCOMMIT_REPOSITORY,
+        type=str,
+        help="GitHub repository to read dashboard issues and artifacts from",
+    )
     return parser.parse_args()
 
 
 def get_issue_hashes(token: str, repo: str):
-    issue_url = (
-        f"https://api.github.com/repos/{repo}/issues?page=1&q=is%3Aissue&state=all"
-    )
-    params = {
+    issue_url = f"https://api.github.com/repos/{repo}/issues"
+    query = {"state": "all", "per_page": 100}
+    headers = {
         "Accept": "application/vnd.github+json",
         "Authorization": f"token {token}",
         "X-Github-Api-Version": "2022-11-28",
     }
-    r = requests.get(issue_url, headers=params)
-    response = json.loads(r.text)
-    print(response)
     hashes: List[str] = []
+    seen_hashes: Set[str] = set()
+
+    while issue_url:
+        response = requests.get(issue_url, headers=headers, params=query, timeout=60)
+        if response.status_code != 200:
+            raise RuntimeError(
+                f"Failed to list dashboard issues from {repo}: "
+                f"HTTP {response.status_code}: {response.text[:500]}"
+            )
+        try:
+            issues = response.json()
+        except ValueError as exc:
+            raise RuntimeError(
+                f"GitHub returned invalid JSON while listing issues from {repo}"
+            ) from exc
+        if not isinstance(issues, list):
+            raise RuntimeError(
+                f"GitHub returned {type(issues).__name__}, expected an issue list"
+            )
+        for issue in issues:
+            if "pull_request" in issue:
+                continue
+            match = STATUS_ISSUE_PATTERN.fullmatch(issue.get("title", ""))
+            if match and match.group(1) not in seen_hashes:
+                hashes.append(match.group(1))
+                seen_hashes.add(match.group(1))
 
-    for issue in response:
-        if "pull_request" not in issue:
-            hashes.append(issue["title"].split(" ")[-1])
+        issue_url = response.links.get("next", {}).get("url")
+        query = None
 
     return hashes
 
@@ -62,7 +106,6 @@ def download_summaries(artifact_name: str, token: str, repo: str):
         "rv64_zvl_lmul2_",
         "rv64_zvl_",
         "coord_",
-        "release_14_",
         "release_15_",
         "release_16_",
         "binutils_",
@@ -75,7 +118,12 @@ def download_summaries(artifact_name: str, token: str, repo: str):
         if artifact_id is not None:
             artifact_name = prefix + artifact_name
             break
-    assert artifact_id is not None
+    if artifact_id is None:
+        print(
+            f"No retained dashboard artifact was found for {artifact_name}; "
+            "skipping this issue"
+        )
+        return None
     if artifact_name.startswith(("coord_", "binutils_")) or artifact_name.startswith(
         "release_"
     ):
@@ -87,6 +135,7 @@ def download_summaries(artifact_name: str, token: str, repo: str):
 
 def download_logs(token: str, repo: str, existing_hashes: Set[str]):
     hashes = get_issue_hashes(token, repo)
+    shutil.rmtree("temp", ignore_errors=True)
     os.mkdir("temp")
     hashes = [gcc_hash for gcc_hash in hashes if gcc_hash not in existing_hashes]
 
@@ -224,8 +273,7 @@ def main():
             for file in data_files:
                 os.remove(file)
         existing_hashes: Set[str] = set()
-        download_logs(args.token, "patrick-rivos/riscv-gnu-toolchain", existing_hashes)
-        download_logs(args.token, "patrick-rivos/gcc-postcommit-ci", existing_hashes)
+        download_logs(args.token, args.repo, existing_hashes)
         hashes = sorted(os.listdir("testsuite_runs"))
         for file in data_files:
             with open(file, "w") as csv:
@@ -234,7 +282,7 @@ def main():
                 )
     else:
         existing_hashes = set(os.listdir("testsuite_runs"))
-        download_logs(args.token, "patrick-rivos/gcc-postcommit-ci", existing_hashes)
+        download_logs(args.token, args.repo, existing_hashes)
         new_hashes = sorted(set(os.listdir("testsuite_runs")) - existing_hashes)
         hashes = new_hashes
 
diff --git a/dashboard/plot.py b/dashboard/plot.py
index 1fd650052..318efa3e8 100644
--- a/dashboard/plot.py
+++ b/dashboard/plot.py
@@ -4,6 +4,11 @@
 import plotly.express as px
 
 
+SOURCE_REPOSITORY = os.environ.get(
+    "POSTCOMMIT_REPOSITORY", "riseproject-dev/gcc-postcommit-ci"
+)
+
+
 def clean(old_df: pd.DataFrame):
     df = old_df.replace(" multilib", "", regex=True)
     df.replace(
@@ -98,7 +103,7 @@ def plot_cumulative_state(
         facet_col_spacing=0,  # default is 0.03
         color="tool",
         symbol="tool",
-        title=f'Unique/total{suffix} failures per hash<br><sup>Data sourced from <a href="https://github.com/patrick-rivos/gcc-postcommit-ci">gcc-postcommit-ci</a> and older data from <a href="https://github.com/patrick-rivos/riscv-gnu-toolchain">riscv-gnu-toolchain</a></sup>',
+        title=f'Unique/total{suffix} failures per hash<br><sup>Data sourced from <a href="https://github.com/{SOURCE_REPOSITORY}">gcc-postcommit-ci</a></sup>',
         range_x=[range_min, range_max],
         range_y=[-5, max(df[df["hash_timestamp"] > range_min]["total_fails"]) + 5],
     )
diff --git a/dashboard/tests/test_getdata.py b/dashboard/tests/test_getdata.py
new file mode 100644
index 000000000..0f5421463
--- /dev/null
+++ b/dashboard/tests/test_getdata.py
@@ -0,0 +1,102 @@
+import sys
+import types
+import unittest
+from pathlib import Path
+from unittest import mock
+
+
+DASHBOARD_DIR = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(DASHBOARD_DIR))
+
+compare_module = types.ModuleType("compare_testsuite_log")
+compare_module.Description = object
+compare_module.classify_by_unique_failure = lambda failures: failures
+compare_module.parse_testsuite_failures = lambda _path: {}
+sys.modules.setdefault("compare_testsuite_log", compare_module)
+
+download_module = types.ModuleType("download_artifact")
+download_module.search_for_artifact = lambda *_args, **_kwargs: None
+download_module.download_artifact = lambda *_args, **_kwargs: None
+download_module.extract_artifact = lambda *_args, **_kwargs: None
+sys.modules.setdefault("download_artifact", download_module)
+
+import getdata
+
+
+HASH_1 = "0123456789abcdef0123456789abcdef01234567"
+HASH_2 = "89abcdef0123456789abcdef0123456789abcdef"
+
+
+class FakeResponse:
+    def __init__(self, payload, links=None, status_code=200, text=""):
+        self._payload = payload
+        self.links = links or {}
+        self.status_code = status_code
+        self.text = text
+
+    def json(self):
+        return self._payload
+
+
+class DashboardIssueTests(unittest.TestCase):
+    @mock.patch("getdata.requests.get")
+    def test_get_issue_hashes_paginates_and_filters_titles(self, request_get):
+        request_get.side_effect = [
+            FakeResponse(
+                [
+                    {"title": "ordinary maintenance issue"},
+                    {"title": f"Testsuite Status {HASH_1}"},
+                    {"title": f"Testsuite Status {HASH_2}", "pull_request": {}},
+                ],
+                links={"next": {"url": "https://api.github.com/page/2"}},
+            ),
+            FakeResponse(
+                [
+                    {"title": f"Testsuite Status {HASH_1}"},
+                    {"title": f"Testsuite Status {HASH_2}"},
+                    {"title": "Testsuite Status not-a-hash"},
+                ]
+            ),
+        ]
+
+        self.assertEqual(
+            getdata.get_issue_hashes("token", "riseproject-dev/gcc-postcommit-ci"),
+            [HASH_1, HASH_2],
+        )
+        self.assertEqual(
+            request_get.call_args_list[0].kwargs["params"],
+            {"state": "all", "per_page": 100},
+        )
+        self.assertIsNone(request_get.call_args_list[1].kwargs["params"])
+
+    def test_all_dashboard_status_titles_are_accepted(self):
+        for title in getdata.DASHBOARD_STATUS_TITLES:
+            with self.subTest(title=title):
+                match = getdata.STATUS_ISSUE_PATTERN.fullmatch(f"{title} {HASH_1}")
+                self.assertIsNotNone(match)
+                self.assertEqual(match.group(1), HASH_1)
+
+    def test_non_dashboard_status_titles_are_rejected(self):
+        rejected = [
+            f"ordinary issue {HASH_1}",
+            f"Coordination Branch Testsuite Status {HASH_1}",
+            f"Release 16 Branch Testsuite Status {HASH_1}",
+            "Testsuite Status not-a-hash",
+        ]
+        for title in rejected:
+            with self.subTest(title=title):
+                self.assertIsNone(getdata.STATUS_ISSUE_PATTERN.fullmatch(title))
+
+    @mock.patch("getdata.search_for_artifact", return_value=None)
+    def test_missing_expired_artifact_is_skipped(self, _search):
+        self.assertIsNone(
+            getdata.download_summaries(
+                f"{HASH_1}-current-logs",
+                "token",
+                "riseproject-dev/gcc-postcommit-ci",
+            )
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/docs/postcommit-maintenance-runbook.md b/docs/postcommit-maintenance-runbook.md
new file mode 100644
index 000000000..20fa8db49
--- /dev/null
+++ b/docs/postcommit-maintenance-runbook.md
@@ -0,0 +1,126 @@
+# Post-Commit Maintenance Runbook
+
+This runbook captures the human triage work that accompanies the automated
+RISE GCC post-commit service. The workflows create status issues and artifacts;
+they do not replace maintainer investigation or upstream bug reporting.
+
+## Daily Queue
+
+Start with the open
+[`new-regressions` queue](https://github.com/riseproject-dev/gcc-postcommit-ci/issues?q=is%3Aissue+is%3Aopen+label%3Anew-regressions),
+then review open issues labelled `build-failure`, `testsuite-failure`, or
+`resolved-regressions`. If there are no new failures, no triage action is
+required.
+
+Each `Testsuite Status <gcc-hash>` issue must link to its Actions run. Use the
+run's `*-current-logs`, `*-previous-logs`, report, summary, and build-log
+artifacts when reproducing a result. Artifacts are retained for a limited time,
+so preserve the relevant excerpt in the upstream bug before it expires.
+
+## New Regression Triage
+
+1. Re-run or reproduce the failure on current GCC trunk. Do not report a bug
+   solely from an old status issue.
+2. Confirm the target, libc, ABI, multilib mode, simulator, GCC hash, and exact
+   command line. Record whether the failure is deterministic.
+3. Classify the failure:
+   - For a scan-dump mismatch, first determine whether the test expectation
+     needs updating or code generation changed incorrectly.
+   - For `test for excess errors`, inspect the full testsuite log for the first
+     compiler or assembler diagnostic; the summary line is not the root cause.
+   - For an abort or runtime crash, build the compiler locally and debug the
+     failing command under GDB when a smaller reproducer is not available.
+   - For a GCC internal compiler error, reproduce with `-freport-bug` and attach
+     the generated preprocessed source and environment details.
+4. Minimize the reproducer where practical and search
+   [GCC Bugzilla](https://gcc.gnu.org/bugzilla/) before filing a new bug.
+5. Link the upstream bug from the RISE status issue. Keep the issue open while
+   the regression remains on trunk.
+
+Do not add a deterministic compiler regression to an allowlist merely to make
+the dashboard green.
+
+## Resolved Regressions
+
+For each `resolved-regressions` entry, search the RISE issue history using the
+exact testsuite failure text. Close the earliest originating status issue only
+after confirming the failure no longer exists and that the issue does not
+contain another unresolved regression. Add the fixing commit or upstream bug
+link when known. Close the current issue when it has no remaining actionable
+failure.
+
+## Infrastructure Failures
+
+Treat clone timeouts, artifact expiry, runner loss, disk exhaustion, simulator
+timeouts, and service rate limits separately from compiler regressions. Check
+the complete workflow logs before retrying. Repeated infrastructure failures
+need an issue with the runner label, run URL, frequency, and owner; they must not
+silently become a compiler allowlist entry.
+
+Self-hosted jobs are allowed to erase their GitHub Actions workspace. They must
+therefore run only on ephemeral or dedicated RISE runners carrying all of these
+labels: `self-hosted`, `linux`, `x64`, and `rise-gcc-ci` (plus `ping` for the
+Patchwork polling runner). Never attach the generic label set to a shared
+organization runner.
+
+## Flaky Tests And Allowlists
+
+An allowlist entry must include the observed symptom, affected target scope,
+an upstream bug or RISE issue, and why the failure is considered flaky or
+external. Use the narrowest matching file under `test/allowlist/`.
+
+Post-commit and pre-commit carry separate allowlists. Every applicable change
+must be made in both `riseproject-dev/gcc-postcommit-ci` and
+`riseproject-dev/gcc-precommit-ci`, then validated against at least one clean
+and one affected target.
+
+## Toolchain And Cache Updates
+
+Toolchain changes are published in dependency order:
+
+1. Merge and push `riseproject-dev/riscv-gnu-toolchain-ci@build-frequent`.
+2. Update the post-commit gitlink and `.gitmodules`, then run a manual build.
+3. Update pre-commit only after post-commit has produced a valid baseline.
+
+When source submodule revisions change, bump the numbered cache key everywhere
+it is consumed in the affected repository. Search for `submodules-archive-`
+and verify all restore and save sites use the same new value. A partial cache
+key bump can mix source revisions across jobs.
+
+## Dashboard Recovery
+
+The dashboard ingests only the strict trunk and weekly status title formats
+declared in `dashboard/getdata.py`; coordination, release, binutils, ordinary,
+and malformed issues are excluded. Missing or expired artifacts are skipped and
+reported in the deployment log.
+For a clean rebuild, manually dispatch `Deploy-Dashboard` with `bootstrap=true`
+after at least one full RISE post-commit run has produced retained artifacts.
+Verify the generated CSV timestamps and all Pages links before relying on the
+graph as a service-health signal.
+
+The dashboard job persists generated data by committing to `main`. The RISE
+ruleset must either grant the GitHub Actions app a narrowly reviewed bypass or
+the persistence design must be moved to a dedicated data branch. Do not weaken
+the general pull-request requirement for human changes.
+
+## Required Labels
+
+Create these labels before enabling schedules:
+
+- `new-regressions`, `resolved-regressions`, `build-failure`,
+  `testsuite-failure`, `invalid`, `build-warnings`, and `valid-baseline`;
+- `staging`, `bisect`, `release`, `coord`, `binutils`, and `checking` where the
+  corresponding workflows remain enabled.
+
+Baseline consumers accept only a strict `Testsuite Status <40-hex>` issue with
+the `valid-baseline` label. Staging, invalid, bisect, build-failure, and
+testsuite-failure issues must never be selected.
+
+## Fuzzer Handover Gap
+
+The compiler fuzzer, Csmith installation, daily GCC/LLVM builds, result storage,
+deduplication, reduction, and bisection scripts described in the former
+maintainer notes are not present in these three repositories. Track that as a
+separate handover item. Obtain the repository, runner registration, storage
+location, schedule, compiler paths, service credentials, and retention policy
+before declaring the full CI service transferred.
diff --git a/docs/rise-postcommit-cutover.md b/docs/rise-postcommit-cutover.md
new file mode 100644
index 000000000..cd53f08d8
--- /dev/null
+++ b/docs/rise-postcommit-cutover.md
@@ -0,0 +1,115 @@
+# RISE Post-Commit CI Deployment
+
+This repository owns scheduled GCC RISC-V post-commit builds, baseline status
+issues, comparison artifacts, and the public dashboard consumed by pre-commit
+CI.
+
+## Architecture
+
+The service consumes `riseproject-dev/riscv-gnu-toolchain-ci` as the
+`riscv-gnu-toolchain` submodule on `build-frequent`. Scheduled and manual
+workflows build GCC, upload target artifacts, generate status issues in this
+repository, and publish dashboard pages at:
+
+`https://riseproject-dev.github.io/gcc-postcommit-ci/`
+
+Pre-commit CI reads status issues and artifacts from this repository as its
+baseline source.
+
+## Repository Settings
+
+| Setting | Required value |
+| --- | --- |
+| Actions | Enabled for all workflows |
+| Default branch | `main` |
+| Workflow permissions | Read repository contents by default; workflows that create issues, upload Pages artifacts, or write dashboard commits request explicit permissions |
+| Issues | Enabled |
+| Pages | GitHub Actions source, published from the `github-pages` environment |
+| Environments | `production`, `github-pages` |
+| Branch protection | Require PR validation and migration guard before merging to `main` |
+
+## Secrets And Variables
+
+| Name | Scope | Minimum permission | Purpose | Required for |
+| --- | --- | --- | --- | --- |
+| `GITHUB_TOKEN` | Repository default | Workflow-declared permissions | Issue updates, artifact reads, Pages publish | Shadow and production |
+| `GIST_TOKEN` | RISE service account | Create secret gists only | Optional long issue body overflow storage | Production if gist overflow is retained |
+| `RISE_CI_READ_TOKEN` | Organization or repository | Read Actions artifacts and issues in RISE CI repositories | Reserved for cross-repository consumers; not needed for same-repository post-commit reads | Pre-commit integration |
+| `PATCHWORK_API` | RISE service account | Patchwork check write | Not used by post-commit; documented for full service cutover | Pre-commit production |
+| `PATCHWORK_REPORTING_ENABLED` | Repository variable | N/A | Not used by post-commit | Pre-commit production |
+
+## Runner Inventory
+
+| Workflow/job | Labels | Purpose | Architecture | Required software | Concurrency | Scope |
+| --- | --- | --- | --- | --- | --- | --- |
+| `build-test.yaml` build/test self-hosted jobs | `self-hosted`, `linux`, `x64`, `rise-gcc-ci` | Long multilib GCC builds and tests | Linux x64 | GCC build deps, DejaGnu, QEMU, Python, zip/unzip | Multiple jobs per scheduled run | Dedicated RISE runner group |
+| `rvv-intrinsic-test.yaml` | `self-hosted`, `linux`, `x64`, `rise-gcc-ci` | RVV intrinsic validation | Linux x64 | RVV intrinsic dependencies, compiler toolchain | Low | Dedicated RISE runner group |
+
+GitHub-hosted jobs continue to use `ubuntu-24.04`.
+
+## Bootstrap
+
+1. Merge the RISE toolchain submodule update first.
+2. Confirm self-hosted RISE runners are online with the labels above.
+3. Create the labels listed in `postcommit-maintenance-runbook.md`.
+4. Configure `production` and `github-pages` environments.
+5. Resolve the dashboard bot's `main` ruleset bypass or use a dedicated data
+   branch; do not leave dashboard persistence blocked by branch protection.
+6. Run a manual post-commit workflow on `main`.
+7. Confirm artifacts upload to this repository.
+8. Confirm a `Testsuite Status <hash>` issue is created with `valid-baseline`.
+9. Run `Deploy-Dashboard` and confirm Pages publishes under the RISE URL.
+10. Only then point pre-commit baseline reads at this repository.
+
+For an empty repository bootstrap, use a manual post-commit run to create the
+first valid baseline issue. Do not configure a permanent fallback to any
+non-RISE repository.
+
+## Cutover
+
+1. Merge `riseproject-dev/riscv-gnu-toolchain-ci`.
+2. Fetch the current RISE `main` immediately before preparing the post-commit
+   change. The live dashboard continuously adds generated-data commits; replay
+   the migration commits on top of that current head and never force-push or
+   replace the dashboard history.
+3. Merge this repository with the updated submodule gitlink.
+4. Run one full post-commit workflow and dashboard deployment.
+5. Record the first valid baseline issue and artifact run.
+6. Merge pre-commit CI only after the baseline exists.
+7. Disable legacy schedules after RISE workflows have produced valid artifacts,
+   issues, and dashboard pages.
+
+Before enabling production schedules, update the repository description and
+homepage, make the RISE repository the local `origin`, verify the RISE
+maintainer team/rulesets, and export the old repository's labels, environments,
+Actions settings, Pages configuration, webhooks, Apps, deploy keys, and runner
+registrations. Git pushes do not migrate that service state.
+
+## Governance Handoff
+
+This repository does not currently contain a top-level license file. Before the
+RISE repository is presented as the authoritative project, confirm the code's
+provenance and redistribution terms with the former maintainers and add the
+approved license; changing repository URLs does not itself transfer copyright.
+
+Add `CODEOWNERS` only after the exact RISE maintainer team slug is confirmed,
+and grant ownership to that team rather than to an individual account. Record
+the primary and backup service owners, incident contact, and token-rotation
+owner in the RISE operations system.
+
+## Rollback
+
+1. Disable post-commit schedules in this repository.
+2. Re-enable the previous production schedules only if required to keep service
+   continuity.
+3. Revert the latest post-commit migration commit on `main`.
+4. Keep RISE status issues and artifacts for audit; do not rewrite history or
+   delete remote records.
+5. Re-run the migration guard before attempting cutover again.
+
+## Release Policy
+
+Maintained release workflows include `release_15_` and `release_16_` artifact
+prefixes and use `release-15` and `release-16` branch inputs. The older retired
+release line is no longer scheduled, listed in workflow choices, or consumed by
+dashboard ingestion.
diff --git a/riscv-gnu-toolchain b/riscv-gnu-toolchain
index 7a1bc8034..2abe5d490 160000
--- a/riscv-gnu-toolchain
+++ b/riscv-gnu-toolchain
@@ -1 +1 @@
-Subproject commit 7a1bc8034d754930bc4baa1440e99d214d08ead0
+Subproject commit 2abe5d4903ab3eb99286647d31b3d7d4462fb64f
diff --git a/scripts/check_migration_guards.py b/scripts/check_migration_guards.py
new file mode 100644
index 000000000..9b028bbb6
--- /dev/null
+++ b/scripts/check_migration_guards.py
@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+
+ACTIVE_PATH_PREFIXES = (
+    ".github/",
+    "configure-scripts/",
+    "dashboard/",
+    "docs/",
+    "scripts/",
+    ".gitmodules",
+    ".pre-commit-config.yaml",
+    "README.md",
+)
+
+EXCLUDED_FILES = {"scripts/check_migration_guards.py"}
+EXCLUDED_PREFIXES = ("dashboard/site/", "dashboard/testsuite_runs/")
+
+LEGACY_POSTCOMMIT_OWNER = "patrick" + "-rivos"
+PERSONAL_FORK_OWNER = "pz" + "9115"
+RETIRED_RELEASE = "1" + "4"
+
+FORBIDDEN_PATTERNS = {
+    "legacy pre-commit repository": re.compile("ew" + r"lu/gcc-precommit-ci"),
+    "legacy post-commit repository": re.compile(
+        rf"{LEGACY_POSTCOMMIT_OWNER}/gcc-postcommit-ci"
+    ),
+    "legacy toolchain repository": re.compile(
+        rf"{LEGACY_POSTCOMMIT_OWNER}/riscv-gnu-toolchain"
+    ),
+    "legacy Pages domain": re.compile(rf"{LEGACY_POSTCOMMIT_OWNER}\.github\.io"),
+    "legacy Rivos Patchwork account": re.compile(r"rivoscibot"),
+    "legacy Rivos Patchwork context": re.compile(r"toolchain-ci-rivos"),
+    "Rivos support email": re.compile(r"patchworks-ci@" + r"rivosinc\.com"),
+    "personal fork repository": re.compile(
+        rf"{PERSONAL_FORK_OWNER}/"
+        r"(gcc-precommit-ci|gcc-postcommit-ci|riscv-gnu-toolchain)"
+    ),
+    "active GCC release 14 configuration": re.compile(
+        rf"(gcc[-_ /]?{RETIRED_RELEASE}|release[-_/]?{RETIRED_RELEASE}|"
+        rf"releases/gcc-{RETIRED_RELEASE}|release_{RETIRED_RELEASE}_)",
+        re.IGNORECASE,
+    ),
+}
+
+
+def active_files():
+    output = subprocess.check_output(["git", "ls-files"], text=True)
+    for name in output.splitlines():
+        if name in EXCLUDED_FILES or name.startswith(EXCLUDED_PREFIXES):
+            continue
+        if name.startswith(ACTIVE_PATH_PREFIXES):
+            yield Path(name)
+
+
+def main():
+    failures = []
+    for path in active_files():
+        if not path.exists():
+            continue
+        try:
+            text = path.read_text(encoding="utf-8")
+        except UnicodeDecodeError:
+            continue
+        for label, pattern in FORBIDDEN_PATTERNS.items():
+            for match in pattern.finditer(text):
+                line = text.count("\n", 0, match.start()) + 1
+                failures.append(f"{path}:{line}: {label}: {match.group(0)}")
+
+    if failures:
+        print("Forbidden migration references found in active source/config:")
+        print("\n".join(failures))
+        return 1
+
+    print("Migration ownership guard passed")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())