LoopedBard3 · Sep 11, 2026 · Sep 12, 2026 · Sep 15, 2026 · Sep 15, 2026 · Sep 15, 2026
diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "microsoft.dotnet.helix.jobmonitor": {
+      "version": "11.0.0-beta.26473.104",
+      "commands": [
+        "dotnet-helix-job-monitor"
+      ]
+    }
+  }
+}
diff --git a/NuGet.config b/NuGet.config
@@ -7,7 +7,8 @@
     <clear />
     <!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
     <!--  Begin: Package sources from dotnet-android -->
-    <add key="darc-pub-dotnet-android-ee72c6f" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-android-ee72c6ff/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-android-db080b9" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-android-db080b91/nuget/v3/index.json" />
+    <add key="darc-pub-dotnet-android-db080b9-1" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-android-db080b91-1/nuget/v3/index.json" />
     <add key="darc-pub-dotnet-android-1361e50" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-android-1361e505/nuget/v3/index.json" />
     <!--  End: Package sources from dotnet-android -->
     <!--  Begin: Package sources from dotnet-macios -->

diff --git a/azure-pipelines.yml b/azure-pipelines.yml
@@ -12,6 +12,18 @@ parameters:
   type: boolean
   default: false
 
+variables:
+  # This entrypoint has one implicit stage. Keep asynchronous sends paired with its monitor.
+  - name: EnableHelixJobMonitor
+    value: true
+  # Matrix legs share a phase and queue. Keep their monitor identities distinct across channels.
+  - name: TestRunNamePrefix
+    value: '$(Agent.JobName)_'
+  - template: /eng/common/templates/variables/pool-providers.yml
+  - ${{ if eq(variables['System.TeamProject'], 'internal') }}:
+    # The standalone monitor does not inherit the submitter jobs' variable groups.
+    - group: DotNet-HelixApi-Access
+
 resources:
   containers:
     - container: ubuntu_x64_build_container
@@ -67,3 +79,9 @@ jobs:
       jobParameters:
         ${{ if parameters.onlySanityCheck }}:
           onlySanityCheck: true
+
+  - template: /eng/common/core-templates/job/helix-job-monitor.yml
+    parameters:
+      timeoutInMinutes: 360
+      helixAccessToken: $(HelixApiAccessToken)
+      allowNoHelixJobs: false
diff --git a/docs/benchmarkdotnet.md b/docs/benchmarkdotnet.md
@@ -27,7 +27,6 @@ BenchmarkDotNet is the benchmarking tool that allows to run benchmarks for .NET,
     - [Running In Process](#running-in-process)
     - [CoreRun](#corerun)
     - [dotnet cli](#dotnet-cli)
-    - [Private CLR Build](#private-clr-build)
     - [Private CoreRT Build](#private-corert-build)
 
 ## Main Concepts
@@ -117,6 +116,12 @@ And select one of the benchmarks from the list by either entering its number or
 
 ### Command Line
 
+The microbenchmark `--msbuild-arguments` option passes additional arguments to MSBuild for BenchmarkDotNet's generated project. Use slash-prefixed arguments such as `/p:` or `/t:`, not `-p:` or `-t:`: `CommandLineOptions.ParseAndRemoveStringsParameter` stops collecting values at any token beginning with `-`. Embedded `--` within a `/p:` value is fine, for example:
+
+```text
+--msbuild-arguments /p:PublishReadyToRunCrossgen2ExtraArgs=--target-allows-runtime-code-generation:false
+```
+
 #### Filtering the Benchmarks
 
 You can filter the benchmarks using `--filter $globPattern` console line argument. The filter is **case insensitive**.

diff --git a/docs/benchmarking-workflow-dotnet-runtime.md b/docs/benchmarking-workflow-dotnet-runtime.md
@@ -11,6 +11,7 @@
       - [Install v8 engine](#install-v8-engine)
       - [Run the benchmarks with the interpreter](#run-the-benchmarks-with-the-interpreter)
       - [Run the benchmarks with AOT](#run-the-benchmarks-with-aot)
+      - [Run CoreCLR WASM ReadyToRun with a nightly or VMR SDK](#run-coreclr-wasm-readytorun-with-a-nightly-or-vmr-sdk)
       - [Note about "file ... being used by another process" error](#note-about-file--being-used-by-another-process-error)
     - [dotnet runtime testing for MonoAOT](#dotnet-runtime-testing-for-monoaot)
       - [Prerequisites (Files either built locally (with build.(sh/cmd) or downloaded from payload above (if same system setup) (in this order))](#prerequisites-files-either-built-locally-with-buildshcmd-or-downloaded-from-payload-above-if-same-system-setup-in-this-order)
@@ -204,6 +205,35 @@ Essentially, add `--aotcompilermode wasm` to the `--bdn-arguments=".."`:
     --bdn-arguments="--category-exclusion-filter NoInterpreter NoWASM NoMono --aotcompilermode wasm --logBuildOutput --buildTimeout 3600 --filter <filter>"
 ```
 
+#### Run CoreCLR WASM ReadyToRun with a nightly or VMR SDK
+
+Use an exact SDK version together with a NuGet source containing the matching
+browser runtime/ref, WebAssembly SDK, host-specific Crossgen2, and ILLink
+packages, plus the complete `wasm-tools` pack closure. The source can be a
+downloaded VMR package directory or a coherent feed. Workload manifest updates
+are disabled and only exact versions recorded by the selected SDK are restored
+from that source, so packages cannot float to another build cohort.
+
+```cmd
+/path/to/dotnet/performance$ python3 ./scripts/benchmarks_ci.py \
+    --csproj src/benchmarks/micro/MicroBenchmarks.csproj \
+    -f net11.0 \
+    --dotnet-versions <vmr-sdk-version> \
+    --wasm \
+    --wasm-runtime-flavor CoreCLR \
+    --wasm-ready-to-run \
+    --wasm-workload-source /path/to/vmr/packages \
+    --run-isolated \
+    --bdn-artifacts artifacts/BenchmarkDotNet.Artifacts \
+    --bdn-arguments="--category-exclusion-filter NoWASM --logBuildOutput --buildTimeout 3600 --filter <filter>"
+```
+
+Omit `--dotnet-versions` to use the existing `main` daily-channel SDK
+selection. In that case the package source must contain the product version
+recorded in that SDK's `Microsoft.NETCoreSdk.BundledVersions.props`.
+`PERFLAB_WASM_PACKAGE_VERSION` should remain unset; that override is reserved
+for non-official runtime payloads.
+
 #### Note about "file ... being used by another process" error
 
 If you are seeing warnings like:

diff --git a/docs/sdk-scenarios.md b/docs/sdk-scenarios.md
@@ -4,6 +4,71 @@ An introduction of how to run scenario tests can be found in [Scenarios Tests Gu
 
 - [SDK Build Throughput Scenario](#sdk-build-throughput-scenario)
 
+## SDK performance pipeline
+
+The repository's [azure-pipelines.yml](../azure-pipelines.yml) entrypoint uses
+[sdk-perf-jobs.yml](../eng/pipelines/sdk-perf-jobs.yml) for SDK-based scenario and
+benchmark jobs. It backs the internal `dotnet-performance` pipeline (definition 306)
+and the public `performance-ci` pipeline (definition 38).
+
+The entrypoint always enables asynchronous submission and includes the standalone
+Helix Job Monitor, its pool provider, and its parameters, including on public and PR
+runs. The monitor runs alongside submitters in the same implicit stage, waits for
+their Helix work items, and reports failures to Azure DevOps. The existing manual
+job-selection parameters and schedules are unchanged: public runs always select
+correctness jobs. Internal manual runs must select workloads; leaving all three
+job-selection flags false still includes the monitor and fails because no Helix jobs
+were submitted (`allowNoHelixJobs: false`). Submitter and work-item failures also
+continue to fail the run.
+
+The monitor job has a six-hour timeout (355 minutes for the tool, leaving five minutes
+for it to exit). Existing 320-minute submitter limits and Helix work-item timeouts are
+unchanged. These limits start when the respective job runs; they are not a whole-run
+wall-clock deadline that includes time waiting for agents.
+
+Internal runs, including internal PR runs, import `DotNet-HelixApi-Access`. The
+monitor forwards `$(HelixApiAccessToken)` directly, matching the shared pipeline
+convention. Internal runs use the imported credential. Public runs, including public
+PR runs, do not import that group and use public Helix access. Direct forwarding
+does not change how Azure DevOps expands variables or how the SDK handles tokens.
+Azure DevOps timeline access and result reporting still use the job's
+`System.AccessToken`. The tool is restored from
+`.config/dotnet-tools.json` in its own checkout; `eng/Version.Details.xml` tracks that
+pin alongside the Helix SDK.
+
+Monitor test-run names include the matrix-expanded job display name. This keeps
+different channels in the same phase and Helix queue independent while preserving a
+stable identity when the same leg is retried.
+
+Submitter build logs still use the existing `Logs_*` pipeline artifacts. Benchmark
+results and diagnostics are still uploaded from the Helix work items to PerfLab and
+Helix, respectively. The monitor reports test results and links to Helix consoles; it
+does not download arbitrary Helix uploads into pipeline artifacts. Asynchronous sends
+skip the submitter's `artifacts/helix-results` downloads, which were not published by
+this pipeline. Local `--send-to-helix` runs still wait and download performance reports.
+
+## Blazor workload preparation
+
+SDK Blazor jobs install `wasm-tools` once on the build agent through
+`PreparePayloadWorkItems`, using the SDK in the correlation payload, its bundled
+manifests (`--skip-manifest-update`), and the payload's `NuGet.config`. An installation
+failure stops payload preparation before the job is sent to Helix.
+
+Helix work items use `pre.py publish --has-workload --readonly-dotnet` and
+`post.py --readonly-dotnet`. These flags prevent the scenario helpers from changing
+the shared workload installation; they do not set filesystem permissions. Application
+restore, publish, size measurements, and cleanup of work-item-local outputs still run
+on Helix. Standalone scenario scripts retain their existing workload-management
+defaults.
+
+Workload availability does not select the benchmark's compilation mode. The Minimum
+Template explicitly enables native relinking, while the non-AOT New Template, Pizza,
+and Localized scenarios disable it with `WasmNativeWorkload=false`. AOT scenarios
+enable `RunAOTCompilation=true`. The Localized AOT command passes this property directly
+instead of referencing item metadata as an MSBuild property, which previously dropped
+the AOT argument. Its reported sizes may therefore change when it first runs with AOT
+actually enabled.
+
 ## SDK Build Throughput Scenario
 
 **SDK Build Throughput** is a scenario test that measures the throughput of SDK build process. To be more specific, our test *implicitly calls*

diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
@@ -1,43 +1,47 @@
 <?xml version="1.0" encoding="utf-8"?>
 <Dependencies>
   <ProductDependencies>
-    <Dependency Name="Microsoft.NET.ILLink.Tasks" Version="11.0.0-rc.2.26458.103">
+    <Dependency Name="Microsoft.NET.ILLink.Tasks" Version="11.0.0-rtm.26473.104">
       <Uri>https://github.com/dotnet/dotnet</Uri>
-      <Sha>bcd0a2de8927de44b65f3ad41bef8820ee2b3d0b</Sha>
+      <Sha>cca240e47d0e810f091225e13c7c93aa7e1c5189</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.NET.ILLink" Version="11.0.0-rc.2.26458.103">
+    <Dependency Name="Microsoft.NET.ILLink" Version="11.0.0-rtm.26473.104">
       <Uri>https://github.com/dotnet/dotnet</Uri>
-      <Sha>bcd0a2de8927de44b65f3ad41bef8820ee2b3d0b</Sha>
+      <Sha>cca240e47d0e810f091225e13c7c93aa7e1c5189</Sha>
     </Dependency>
-    <Dependency Name="System.Threading.Channels" Version="11.0.0-rc.2.26458.103">
+    <Dependency Name="System.Threading.Channels" Version="11.0.0-rtm.26473.104">
       <Uri>https://github.com/dotnet/dotnet</Uri>
-      <Sha>bcd0a2de8927de44b65f3ad41bef8820ee2b3d0b</Sha>
+      <Sha>cca240e47d0e810f091225e13c7c93aa7e1c5189</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.Extensions.Logging" Version="11.0.0-rc.2.26458.103">
+    <Dependency Name="Microsoft.Extensions.Logging" Version="11.0.0-rtm.26473.104">
       <Uri>https://github.com/dotnet/dotnet</Uri>
-      <Sha>bcd0a2de8927de44b65f3ad41bef8820ee2b3d0b</Sha>
+      <Sha>cca240e47d0e810f091225e13c7c93aa7e1c5189</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.WindowsDesktop.App.Ref" Version="11.0.0-rc.2.26458.103">
+    <Dependency Name="Microsoft.WindowsDesktop.App.Ref" Version="11.0.0-rtm.26473.104">
       <Uri>https://github.com/dotnet/dotnet</Uri>
-      <Sha>bcd0a2de8927de44b65f3ad41bef8820ee2b3d0b</Sha>
+      <Sha>cca240e47d0e810f091225e13c7c93aa7e1c5189</Sha>
     </Dependency>
     <Dependency Name="Microsoft.NET.Runtime.Emscripten.3.1.56.Node.win-x64" Version="11.0.0-preview.5.26261.101">
       <Uri>https://github.com/dotnet/dotnet</Uri>
       <Sha>547c640d5626b2976499cb3433abc741a63d67c5</Sha>
     </Dependency>
   </ProductDependencies>
   <ToolsetDependencies>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="11.0.0-beta.26458.103">
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="11.0.0-beta.26473.104">
       <Uri>https://github.com/dotnet/dotnet</Uri>
-      <Sha>bcd0a2de8927de44b65f3ad41bef8820ee2b3d0b</Sha>
+      <Sha>cca240e47d0e810f091225e13c7c93aa7e1c5189</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.DotNet.Helix.Sdk" Version="11.0.0-beta.26458.103">
+    <Dependency Name="Microsoft.DotNet.Helix.Sdk" Version="11.0.0-beta.26473.104">
       <Uri>https://github.com/dotnet/dotnet</Uri>
-      <Sha>bcd0a2de8927de44b65f3ad41bef8820ee2b3d0b</Sha>
+      <Sha>cca240e47d0e810f091225e13c7c93aa7e1c5189</Sha>
     </Dependency>
-    <Dependency Name="Microsoft.DotNet.XHarness.CLI" Version="11.0.0-prerelease.26458.2">
+    <Dependency Name="Microsoft.DotNet.Helix.JobMonitor" Version="11.0.0-beta.26473.104">
+      <Uri>https://github.com/dotnet/dotnet</Uri>
+      <Sha>cca240e47d0e810f091225e13c7c93aa7e1c5189</Sha>
+    </Dependency>
+    <Dependency Name="Microsoft.DotNet.XHarness.CLI" Version="11.0.0-prerelease.26473.1">
       <Uri>https://github.com/dotnet/xharness</Uri>
-      <Sha>1665037768fd7eec44e046d94fd07b8c6407c966</Sha>
+      <Sha>64629bf55dc3bf7bddf2ec24670950c02ba451ea</Sha>
     </Dependency>
     <!--
       Maui Rollback Version mappings, default means generated from sdk version. Allows for manual override of version similar to https://github.com/dotnet/maui/blob/df8cfcf635a590955a8cc3d6cf7ae6280449dd3f/eng/Versions.props#L138-L146, where the logic comes from:
@@ -51,21 +55,21 @@
       Mapping_Microsoft.tvOS.Sdk:default
     -->
     <!-- Dependencies for .NET MAUI workload -->
-    <Dependency Name="Microsoft.Maui.Controls" Version="10.0.110-ci.main.26458.5">
-      <Sha>2805bd2ff835d56183bc24790978db678711c770</Sha>
+    <Dependency Name="Microsoft.Maui.Controls" Version="10.0.120-ci.inflight.26472.9">
+      <Sha>0fb2d2e873627b4fd88b20ffa17c5d3b20b4441c</Sha>
       <Uri>https://github.com/dotnet/maui</Uri>
     </Dependency>
-    <Dependency Name="Microsoft.NET.Sdk" Version="11.0.100-rc.2.26458.103">
-      <Sha>bcd0a2de8927de44b65f3ad41bef8820ee2b3d0b</Sha>
+    <Dependency Name="Microsoft.NET.Sdk" Version="11.0.100-rtm.26473.104">
+      <Sha>cca240e47d0e810f091225e13c7c93aa7e1c5189</Sha>
       <Uri>https://github.com/dotnet/dotnet</Uri>
     </Dependency>
-    <Dependency Name="Microsoft.NETCore.App.Ref" Version="11.0.0-rc.2.26458.103">
-      <Sha>bcd0a2de8927de44b65f3ad41bef8820ee2b3d0b</Sha>
+    <Dependency Name="Microsoft.NETCore.App.Ref" Version="11.0.0-rtm.26473.104">
+      <Sha>cca240e47d0e810f091225e13c7c93aa7e1c5189</Sha>
       <Uri>https://github.com/dotnet/dotnet</Uri>
     </Dependency>
-    <Dependency Name="Microsoft.Android.Sdk.Windows" Version="36.1.115">
+    <Dependency Name="Microsoft.Android.Sdk.Windows" Version="36.1.118">
       <Uri>https://github.com/dotnet/android</Uri>
-      <Sha>ee72c6ff89ce0b2609b21fc5b0897741cae8dc5c</Sha>
+      <Sha>db080b91dbe7947a69005a203ea98d9bb207ad04</Sha>
     </Dependency>
     <Dependency Name="Microsoft.NET.Workload.Emscripten.Current.Manifest-9.0.100" Version="9.0.1">
       <Sha>4c9d1b112c16716c2479e054e9ad4db8b5b8c70c</Sha>

diff --git a/eng/Versions.props b/eng/Versions.props
@@ -7,13 +7,13 @@
   </PropertyGroup>
   <!--Package versions-->
   <PropertyGroup>
-    <MicrosoftNETILLinkTasksVersion>11.0.0-rc.2.26458.103</MicrosoftNETILLinkTasksVersion>
-    <MicrosoftNETILLinkPackageVersion>11.0.0-rc.2.26458.103</MicrosoftNETILLinkPackageVersion>
-    <SystemThreadingChannelsPackageVersion>11.0.0-rc.2.26458.103</SystemThreadingChannelsPackageVersion>
-    <MicrosoftExtensionsLoggingPackageVersion>11.0.0-rc.2.26458.103</MicrosoftExtensionsLoggingPackageVersion>
+    <MicrosoftNETILLinkTasksVersion>11.0.0-rtm.26473.104</MicrosoftNETILLinkTasksVersion>
+    <MicrosoftNETILLinkPackageVersion>11.0.0-rtm.26473.104</MicrosoftNETILLinkPackageVersion>
+    <SystemThreadingChannelsPackageVersion>11.0.0-rtm.26473.104</SystemThreadingChannelsPackageVersion>
+    <MicrosoftExtensionsLoggingPackageVersion>11.0.0-rtm.26473.104</MicrosoftExtensionsLoggingPackageVersion>
     <BenchmarkDotNetVersion>0.16.0-nightly.20260801.595</BenchmarkDotNetVersion>
     <MicrosoftNETRuntimeEmscripten3156Nodewinx64Version>11.0.0-preview.5.26261.101</MicrosoftNETRuntimeEmscripten3156Nodewinx64Version>
-    <MicrosoftDotNetXHarnessCLIVersion>11.0.0-prerelease.26458.2</MicrosoftDotNetXHarnessCLIVersion>
+    <MicrosoftDotNetXHarnessCLIVersion>11.0.0-prerelease.26473.1</MicrosoftDotNetXHarnessCLIVersion>
   </PropertyGroup>
   <!--Package names-->
   <PropertyGroup>

diff --git a/eng/common/core-templates/job/helix-job-monitor.yml b/eng/common/core-templates/job/helix-job-monitor.yml
@@ -52,11 +52,23 @@ parameters:
   type: string
   default: https://helix.dot.net/
 
-# Helix API access token forwarded to the tool via the HELIX_ACCESSTOKEN environment variable.
+# Helix API access token forwarded via HELIX_ACCESSTOKEN. Not forwarded when
+# useEntraAuthentication is true.
 - name: helixAccessToken
   type: string
   default: ''
 
+# Use a refreshable Entra credential instead of a PAT or anonymous access.
+- name: useEntraAuthentication
+  type: boolean
+  default: false
+
+# Azure service connection ID authorized for Helix. Required when
+# useEntraAuthentication is true.
+- name: azureSubscription
+  type: string
+  default: ''
+
 # Polling interval in seconds (--polling-interval-seconds).
 - name: pollingIntervalSeconds
   type: number
@@ -141,6 +153,26 @@ jobs:
   - checkout: self
     fetchDepth: 1
 
+  - ${{ if and(eq(parameters.useEntraAuthentication, true), eq(parameters.azureSubscription, '')) }}:
+    - pwsh: throw "azureSubscription must be set when useEntraAuthentication is true."
+      displayName: Validate Helix Entra authentication
+
+  - ${{ if eq(parameters.useEntraAuthentication, true) }}:
+    - task: AzureCLI@2
+      displayName: Initialize Helix Entra authentication
+      inputs:
+        azureSubscription: ${{ parameters.azureSubscription }}
+        addSpnToEnvironment: true
+        scriptType: pscore
+        scriptLocation: inlineScript
+        inlineScript: |
+          if ([string]::IsNullOrWhiteSpace($env:servicePrincipalId) -or [string]::IsNullOrWhiteSpace($env:tenantId)) {
+            throw "The Helix Azure service connection did not provide a service principal or tenant ID."
+          }
+
+          Write-Host "##vso[task.setvariable variable=HelixEntraClientId]$env:servicePrincipalId"
+          Write-Host "##vso[task.setvariable variable=HelixEntraTenantId]$env:tenantId"
+
   - ${{ if ne(parameters.toolNupkgArtifactName, '') }}:
     - task: DownloadPipelineArtifact@2
       displayName: Download Helix Job Monitor artifact
@@ -214,6 +246,7 @@ jobs:
 
       toolArgs=(
         --helix-base-uri              '${{ parameters.helixBaseUri }}'
+        --use-entra-authentication    '${{ parameters.useEntraAuthentication }}'
         --polling-interval-seconds    '${{ parameters.pollingIntervalSeconds }}'
         --fail-on-failed-tests        '${{ parameters.failWorkItemsWithFailedTests }}'
         --allow-no-helix-jobs         '${{ parameters.allowNoHelixJobs }}'
@@ -275,4 +308,9 @@ jobs:
     displayName: Monitor Helix Jobs
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
-      HELIX_ACCESSTOKEN: ${{ parameters.helixAccessToken }}
+      ${{ if eq(parameters.useEntraAuthentication, false) }}:
+        HELIX_ACCESSTOKEN: ${{ parameters.helixAccessToken }}
+      ${{ if eq(parameters.useEntraAuthentication, true) }}:
+        AZURESUBSCRIPTION_CLIENT_ID: $(HelixEntraClientId)
+        AZURESUBSCRIPTION_TENANT_ID: $(HelixEntraTenantId)
+        AZURESUBSCRIPTION_SERVICE_CONNECTION_ID: ${{ parameters.azureSubscription }}