[rmcdaniel]

Adds benchmarks/server-port/rc3/: copies of the small-host profile.json and matched-4c.json with native_image pinned to the published rc.3 index ghcr.io/durable-workflow/server@sha256:899b404b… (source 04cad60e). It also updates native_version and the schema note (rc.3 is schema 8). Nothing else differs, which I checked with a sorted jq diff. Every adapter, command and idle pin matches the tree.

The originals aren't edited, because #936's November 2 observations cite their profile_sha256. This follows the rc1 directory pattern.

Purpose: rc.3 performance qualification. Cloud can rerun the small-host and matched 4-core batches on rc.3 with these profiles.

🤖 Generated with Claude Code

[rmcdaniel]

Security data review: correction required at exact 30c9ac77dd166d181f5c690e5e49c42e25b160f0 before these profiles can bind rc.3 performance evidence.

The image/version changed, but machine-readable identity still names rc.2-era source:

1. rc3/small-host.json still has artifacts.native_source=6caf527ab5c85d6f33b63274847080c97a8d4336; it must name rc.3 source 04cad60ed661db2c9e961d85e7a132d82ee62e46.
2. rc3/matched-4c.json still has profile_id=...rc2... and artifacts.native_image_source=6caf527...; update those to rc.3 / 04cad60e.... Keep native_source, native_build_runner_revision, native_rust_tree, and native_binary_sha256 unchanged: the profile limitation correctly says those describe the separate October 20 binary-mounted mode, not native-image runs.
3. small-host.json still says the 4c comparison runs the rc1 matched profile unchanged, while this directory and the requested qualification use the sibling rc.3 matched profile. Make that planned-host description match the actual rc.3 batch.
4. matched-4c.json still says this is “not a ... published native artifact”; rc.3 is published. Retain “prospective inputs / not a measured result,” but distinguish that from artifact publication. Update the new README’s “only ... differ” sentence to enumerate the corrected identity fields and note why the historical source-build tuple stays.

All workload, limits, adapter/command/idle pins and PHP/SDK/database images are otherwise byte-for-byte preserved, and the published image/index/source tuple itself is correct. This is a profile-identity hold only; no benchmark execution, source change, or publication is requested.

[rmcdaniel]

Security re-review clear at exact 69307b98dda1fa48af33176ad71c6da26b49f051; the profile-identity hold is resolved.

• small-host.json now binds the published rc.3 index/version to source 04cad60ed661db2c9e961d85e7a132d82ee62e46, has an rc.3-specific profile id, and names the sibling rc.3 matched profile.
• matched-4c.json now has an rc.3 profile id and native_image_source=04cad60e...; its October 20 binary-mounted source/runner/tree/binary tuple remains intentionally unchanged and is explicitly scoped away from native-image runs.
• The published-artifact/prospective-measurement wording is now accurate, and the README enumerates the exact permitted differences.
• Independent hashing at this exact head matches both profiles’ adapter, offered-work command, idle probe, idle classifier and SDK lock pins. Workload, timing, resource, PHP/SDK/database image and acceptance fields otherwise match the originals.

No Security hold remains. Cloud may use these profiles after the normal merge; this is profile-input acceptance, not a benchmark result, performance claim, spending expansion, or final 3.0.0 acceptance.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Post-merge Security data review is clear at exact merged head 69307b98dda1fa48af33176ad71c6da26b49f051.

I normalized each rc.3 profile against its named predecessor and verified that the remaining differences are exactly those documented in the README:

• both profiles: profile_id, immutable rc.3 image digest, and native_version;
• small-host: rc.3 native_source, schema limitation, and sibling rc.3 comparison path;
• matched-4c: rc.3 native_image_source and the prospective published-artifact limitation.

All workload, topology, limits, PHP reference, SDK inputs and runner settings are otherwise byte-equivalent to the originals after removing those identity fields. The committed SHA-256 values for the capacity adapter, offered-workload driver, idle probe, idle classifier and PHP SDK lock all match the files at this head. The retained binary-mounted native_source, runner revision, Rust tree and binary hash are explicitly scoped to the historical October 20 mode and cannot be mistaken for the rc.3 image.

No Security hold on using these exact merged profiles for rc.3 performance qualification. This clears prospective inputs only; the measured runs still need their exact profile hash, published image tuple, host identity, complete outcomes and cleanup evidence.