v1.3.0

1.3.0 (2026-08-18)

Features

• show git clone progress in review spinner (6f274f0)
• linear: add linear-test, quieten the defaults, rewrite the README (2dfd0aa)
• linear: per-step actor names and the shared identity contract (d164bcb)
• linear: surface the attribution ladder and enrich the signature (57e621c)
• linear: tiered Linear identity and review write-back (129bccd)
• linear: verify identity attribution from crosscheck status (9c01851)
• add crosscheck adoption, measuring real usage from local logs (#295) (df89c41), closes #202
• add per-step skill activation broker (67475b3)
• adopt the review strategy at runtime, surface it in onboard, restore the smart default (#280) (ccf264d), closes #279
• attribute skills per workflow step (9936373)
• bundle recommended agent skill catalog (53875b0)
• dynamic thoroughness — per-PR model and effort selection (#279) (ac04cd8)
• expose all six codex reasoning tiers in vendors.codex.effort (9dadcba)
• honor codex model config under subscription auth (c9d7abc)
• honor repository review guidance (c2dfdaa)
• inject skills into coding agent steps (1b0c257)
• install agent skills with provenance (aff0a05)
• pass vendors.codex.effort as codex reasoning effort (b4712ae)
• preload engineering skills (100cc63)
• recommend compatible agent skills (f1e3f4c)
• verify skill package integrity (9971b82)
• attribution: one shared footer for every posted card, with model and effort (#276) (96263ab)
• onboard: mark Linear write-back as beta and stop prompting for it (#277) (92f63e4)
• stop working a PR once its latest verdict is APPROVE (#281) (3af82c0)

Bug Fixes

• ci: promote staging via PR, and email yi@ when a release publishes (#278) (74caf20)
• ci: unblock the release pipeline and restore the production gate (#288) (8d0d4bc)
• linear: address crosscheck review — runner wiring, scopes, host anchoring (c5ba911), closes #257
• linear: address recheck — abort on auth failure, parse URLs, fix metadata (26d3375), closes #257
• linear: address review — blank clear, narrower tidying, contract version (4932f59)
• linear: address review — config reference and contract wording (c0547e7)
• linear: board and auth ahead of the clone; gate the startup preflight (9c29ae5), closes #257
• linear: bound and parallelise the Linear status probe (c4396cc)
• linear: bump to 0.20.0 for the new command; reuse the verified identity (aaa9d81), closes #261
• linear: gate preflight on verdict-writing steps; surface watch failures (1c543ff), closes #257
• linear: honour the no-write gate in the runner; name rejected credentials (77c916d), closes #257
• linear: iterate scheme-less URL candidates; gate for round-mode rechecks (4d86f05), closes #257
• linear: NEEDS WORK was silently dropped; dry-run and exit-code fixes (a18fdb0), closes #257
• linear: onboarding could disable a working integration; harden linear-test (5159294), closes #261
• linear: one auth predicate everywhere; parse the identifier segment whole (940b39d), closes #257
• linear: outage exit codes, preflight placement, ref punctuation (ac92cdc), closes #257
• linear: preflight Linear at watch startup, not silently per event (a1e09eb), closes #257
• linear: punctuated URLs keep their workspace; accept 1-char team keys (c5500f4), closes #257
• linear: scope runner write-back to the step actor (216f11c)
• linear: watch fails fast on auth; recheck comments say recheck (316784f), closes #257
• linear: workspace safety, one token per run, outage classification (a2dba33), closes #257
• runner: retry base-branch fetch so a blip cannot disable auto-fix (ed3e6ea), closes humanbased-ai/crosscheck#257
• address CR issues in fix: land auto-fixes on the PR branch instead of always opening a follow-up PR (#287) (c5d9743), closes #286
• address CR issues in fix(ci): unblock the release pipeline and restore the production gate (#289) (0034e8f), closes #288
• classify a failed clone by its cause, not by the token in its URL (#292) (dce4886), closes #191
• close an auto-fix PR when the PR it was cut from merges (#296) (a1a504a), closes humanbased-ai/monorepo#2527 #2532 #291
• commit subjects credit the vendor that did the work, not always Claude (#285) (8b240e6)
• conflict-resolve skipped every unattributed PR, and reported the no-op as success (#284) (7975d48), closes humanbased-ai/monorepo#2488 #1725
• do not fix a review against a commit that is no longer HEAD (#300) (3c103ef), closes monorepo#2548 monorepo#2591 monorepo#2595
• harden skill integration (f9b24a9)
• keep picker hints within terminal width (abdacf0)
• land auto-fixes on the PR branch instead of always opening a follow-up PR (#286) (a060d43)
• make Agent Skills actually reachable from Codex (0 activations in 244 runs) (#298) (6c7574f), closes humanbased-ai/monorepo#2565
• make the separate-fix-PR fallback work in the cases it exists for (#297) (0a69f30), closes #290
• resolve conflicts for the whole life of a PR, not just before the first review (#283) (4f6160e), closes #282
• restore Codex skill activation attribution (e01b5b9)
• secure skill broker state and provenance (#273) (f9314e9)
• skills: make skill activation an obligatory, step-aware first step (#275) (348c697)
• verify the reviewed sha against the repo before posting a verdict (#293) (bc21b87), closes humanbased-ai/monorepo#2444 #290

Code Refactoring

• remove unused mergePullRequest export (#303) (86e7ce9)

Documentation

• linear: add screenshots for onboarding, status, and the posted comment (b1749cc)
• align the full config reference with this branch's schema (b2f132d), closes #257
• correct legal entity name and surface screenshots in README and guides (8804849)
• document the permission, webhook, and mutation model in one place (#294) (b7d81d7), closes #199

What's Changed

• fix: remove --bare from issue command to restore OAuth support by @Trump-One in #91
• [crosscheck] fix: apply CR fixes from review of PR #89 — by Claude Code by @beingzy in #98
• fix: pipe prompt via stdin in claude reviewer by @Trump-One in #97
• fix: prefer ~/.crosscheck/config.yml over cwd in config discovery by @kay404 in #99
• feat: add clone_protocol config for ssh/https selection by @chababa9 in #100
• feat: smart-switch — subscription-limit fault tolerance for cross-vendor mode by @beingzy in #101
• fix: robust verdict parsing and persistent crosscheck SHA tracking by @beingzy in #103
• release: verdict parsing, persistent SHA cache, smart-switch, clone protocol by @beingzy in #104
• feat(picker): fixed-height viewport with / filter and PageUp/PageDown by @kay404 in #105
• fix(ci): don't push version-bump commit to protected main by @beingzy in #106
• fix(ci): don't push version-bump commit to protected main by @beingzy in #107
• feat: track and display token usage per workflow step by @beingzy in #108
• fix: infer VERDICT from Codex [P1]/[P2]/[P3] priority markers by @beingzy in #109
• fix(ci): use semver dry-run to compute next stable version for beta/alpha stamps by @beingzy in #110
• docs: reposition README around Auto Code Review Pipeline by @beingzy in #111
• chore: release staging → main by @beingzy in #112
• fix(ci): fall back to github.token when RELEASE_TOKEN secret is not set by @beingzy in #113
• fix(ci): open a sync PR when direct push to protected staging is rejected by @beingzy in #114
• fix(ci): long-term fix for staging sync — PR + auto-merge, never direct push by @beingzy in #115
• fix(ci): skip npm publish when version already exists on registry by @beingzy in #116
• fix: restore .codex/instructions after Codex review to prevent false recheck findings by @beingzy in #117
• fix: switch fix step to edit-block format, add size guard against truncation by @beingzy in #118
• fix: switch fix step to edit-block format with safety guards by @beingzy in #120
• feat: retry fix step on transient failure, notify PR author on final failure by @beingzy in #122
• fix(onboard): regenerate workflow.yml on preset downgrade by @chababa9 in #119
• release: v0.9.1 — fix step reliability and CI hardening by @beingzy in #123
• fix: ask which AI you primarily use during onboard; fix --reconfigure routing by @beingzy in #125
• feat: recheck round tracking + max_rounds onboard prompt by @beingzy in #126
• release: merge staging → main (0.11.0 → 0.12.0) by @beingzy in #127
• fix: use full detection chain in review command by @beingzy in #129
• fix: resolve merge conflict markers in board.ts by @beingzy in #130
• release: merge staging → main by @beingzy in #128
• feat: add in-flight lock to prevent duplicate reviews by @beingzy in #131
• fix: recheck comments link to original review and carry annotation tags by @beingzy in #132
• fix: annotation origin= always present; field order matches documented contract by @beingzy in #133
• fix: show CR as prior-round when displaying round 2+ PR stripe by @beingzy in #134
• feat: add conflict-resolve workflow step with onboard opt-in by @beingzy in #135
• feat: reorder watch board layout (config → stats → PR workspace) by @beingzy in #138
• fix: align cross-vendor routing with multi-agent usage by @beingzy in #137
• feat: add condition checks to conflict-resolve step by @beingzy in #136
• fix: harden conflict marker check against PR-controlled inputs by @beingzy in #139
• fix(ci): harden publish workflow (provenance, idempotency, node 22) by @beingzy in #140
• fix: scope [crosscheck] commit guard to commits ahead of base by @beingzy in #142
• fix: re-raise signals after PR-lock cleanup when sole listener by @beingzy in #143
• Promote staging to main by @beingzy in #141
• fix: release pushed-sha pending statuses from the run signal handler by @beingzy in #145
• fix: prefer PR side in conflict-resolve prompt; refresh remote lock to newSha by @beingzy in #144
• feat: human-readable duration in watch board by @Trump-One in #147
• fix: dedup webhook scopes and skip no-diff re-reviews by @beingzy in #148
• feat: post summary comment after silent-commit fix and conflict-resolve by @beingzy in #149
• feat(log): add step_type, step_name, vendor, duration_ms to completion events by @beingzy in #152
• feat(log): emit workflow_complete event in runWorkflow finally by @beingzy in #153
• docs: auto-fix gate redesign — outcome-based invariant, bounded loop, single gate by @beingzy in #151
• docs: redesign telemetry around versioned categories with idle upload by @beingzy in #150
• docs: add scan kickass PRD tickets by @beingzy in #157
• fix: harden crosscheck review deduping by @beingzy in #154
• feat: add model-aware review headers by @beingzy in #156
• feat: add annotation contract v2 by @beingzy in #155
• feat: add PR status scanner by @beingzy in #158
• feat: add scan command by @beingzy in #159
• feat: add scan and kickass operator queue by @beingzy in #160
• feat: add kickass operator command by @beingzy in #163
• refactor: dedupe PR status annotation parser by @beingzy in #161
• feat: add scan command by @beingzy in #162
• docs: rewrite README with per-command sections + mark scan/kickass done in prd by @beingzy in #165
• Promote to stable release with cutting-edge features by @beingzy in #167
• feat: rename PR states + add --reviewer vendor aliases by @beingzy in #166
• feat: supercharge kickass — all actionable PRs, fix→recheck cycles, --crazy/--halfcrazy by @beingzy in #168
• feat: add --timeout flag; crazy/halfcrazy lift all timeout constraints by @beingzy in #169
• feat: --timeout flag, --crazy/--half-crazy autonomous loop modes by @beingzy in #170
• feat: --concurrent flag for kickass — parallel PR execution by @beingzy in #172
• feat: remove crazy/half-crazy round ceiling — loop runs until stop condition by @beingzy in #171
• feat: configurable per-vendor review timeout (vendors.*.timeout_sec) by @kay404 in #173
• feat: data-driven logging — pr_complexity, token split, trigger source, retention 30d by @beingzy in #174
• fix: correct network mis-categorization and add retry in kickass by @beingzy in #177
• feat: identify next workflow step from PR comment history + detect-step command by @beingzy in #178
• fix: revert incorrect fixAfterReview shortcut that caused BLOCK rechecks to report 'nothing to do' by @beingzy in #179
• feat: adopt pr-workflow-state as unified next-step resolver across watch, serve, and kickass by @beingzy in #180
• fix: codex fix step, vendor fallback, concurrent stagger, network error handling by @beingzy in #181
• fix: vendor fallback for human-origin PRs in fix step by @beingzy in #182
• [codex] Fix detect-step workflow history by @beingzy in #183
• feat: add step vendor overrides and fallback by @beingzy in #185
• fix: improve kickass empty queue picker by @beingzy in #186
• fix: honor quality.tier for claude reviewer timeout default by @chababa9 in #192
• fix(diagnose): classify transient 429/529/budget errors as distinct patterns by @Trump-One in #196
• [codex] migrate crosscheck to HumanBased by @beingzy in #197
• fix: kickass+watch combo — detect-step routing and review→fix bridge by @beingzy in #193
• fix(models): honor vendors.claude.model instead of locking to quality.tier by @Trump-One in #194
• fix(logger): stop misclassifying transient 429/529/budget errors as auth by @Trump-One in #195
• chore: update license responsible party by @beingzy in #204
• feat: watch-style PRBoard display for ck kickass by @beingzy in #206
• docs: execute first growth cycle by @beingzy in #207
• docs: add agentic growth loop by @beingzy in #205
• feat: retry reviewer timeouts once before reporting failure by @chababa9 in #210
• feat: diagnose/optimize improvements + watch mode education tips by @beingzy in #209
• feat(verdict): severity gate — only Critical/High block (IN-628) by @Trump-One in #208
• feat(watch): post a PR-visible failure comment when the reviewer subprocess fails by @chababa9 in #212
• chore: promote staging to main by @beingzy in #213
• fix(verdict): treat [P2] findings as blocking in severity gate by @beingzy in #214
• feat: surface error category and remediation hints on workflow failures by @beingzy in #215
• fix(fix-step): tier-aware timeouts and correct retry vendor after double failure by @beingzy in #216
• docs: wire field report into growth cycle by @beingzy in #211
• fix: improve --crazy mode reliability by @beingzy in #217
• feat: diagnose --pr analysis, issue queue, and watch idle-issue timer by @beingzy in #218
• feat: enrich auto-fix comment with issues addressed, files changed, and vendor attribution by @beingzy in #219
• docs: rewrite README intro and add use-cases section by @beingzy in #220
• chore: promote staging to main — v1.1.0 by @beingzy in #221
• fix(watch): make max_rounds an autonomous fix→recheck cycle cap by @beingzy in #222
• feat(kickass): run PRs concurrently by default + automate beta publish by @beingzy in #224
• fix: keep live board within viewport height to prevent scrollback residue by @kay404 in #223
• fix: record the model that actually served the review, not the requested alias by @kay404 in #225
• fix: keep settled PR slots folded across recheck rounds (sticky fold) by @kay404 in #227
• feat: multi-PR specs + recheck/fix/resolve step commands by @beingzy in #226
• chore: reconcile staging → main + align version to 0.18.0 by @beingzy in #228
• chore: sync main → staging (features + 0.18.0) to match branches by @beingzy in #229
• fix: skip merged/closed PRs + log zero-change fixes by @beingzy in #230
• chore: align package.json to 0.18.0 release line by @beingzy in #231
• chore: verify push access (harmless no-op) by @Trump-One in #234
• fix(runner): fall back to healthy vendor when a reviewer is unavailable (IN-1106) by @Trump-One in #236
• fix: release remote lock in finally block by @rain2004-rr in #232
• fix: add retry logic for git and Claude API errors by @rain2004-rr in #233
• chore: add @lhdiyiwudi as a global code owner by @beingzy in #235
• feat(harness): extract default workflow instructions into bundled harness file by @beingzy in #241
• fix: improve git auth and network error handling by @rain2004-rr in #237
• feat(config): add OpenAI model tiers and smart quality mode by @beingzy in #240
• fix(runner): retry review/recheck on transient 429/529 API errors by @beingzy in #238
• ci: weekly staging→main auto-promotion, remove manual release gate by @beingzy in #242
• feat(workflow): support custom harness per workflow step by @beingzy in #239
• feat!: add watch --only-review flag; remove serve command by @kay404 in #243
• release: promote staging to main for production by @beingzy in #244
• feat!: per-repo workflow overrides (file-based) + default review→fix→recheck by @beingzy in #245
• feat: --port flag for watch/serve + soft-deprecate serve by @beingzy in #246
• feat: source review tier model mapping by @beingzy in #248
• fix: address CR issues in feat(enrich): anchor reviews to the linked Linear issue's goal by @beingzy in #252
• fix: strip temp clone dir prefix from codex review paths by @kay404 in #250
• feat(enrich): anchor reviews to the linked Linear issue's goal by @Trump-One in #251
• Update code owners by @beingzy in #253
• refactor(enrich): fetch tracker issue after locks; loosen the goal instruction by @Trump-One in #254
• feat: support review,recheck per-repo workflow depth by @beingzy in #249
• release: promote staging to main for production by @beingzy in #255
• feat: show git clone progress in review spinner by @kay404 in #256
• feat(linear): per-step actor names and the shared identity contract by @beingzy in #258
• feat(linear): verify identity attribution from crosscheck status by @beingzy in #259
• feat(linear): tiered Linear identity and review write-back by @beingzy in #257
• fix(runner): retry base-branch fetch so a blip cannot disable auto-fix by @beingzy in #262
• feat: honor codex model config under subscription auth by @kay404 in #260
• feat(linear): attribution ladder, linear-test, and README rewrite by @beingzy in #261
• feat: pass vendors.codex.effort as codex reasoning effort by @kay404 in #263
• feat: preload engineering skills by @beingzy in #271
• feat: bundle recommended agent skill catalog by @beingzy in #264
• feat: install agent skills with provenance by @beingzy in #265
• feat: add per-step skill activation broker by @beingzy in #266
• feat: inject skills into coding agent steps by @beingzy in #267
• feat: attribute skills per workflow step by @beingzy in #268
• feat: verify skill package integrity by @beingzy in #269
• feat: honor repository review guidance by @beingzy in #270
• feat: recommend compatible agent skills by @beingzy in #272
• fix: restore Codex skill activation attribution by @beingzy in #274
• fix: secure skill broker state and provenance by @beingzy in #273
• fix(skills): make skill activation an obligatory, step-aware first step by @beingzy in #275
• feat(attribution): one shared footer for every posted card, with model and effort by @beingzy in #276
• feat(onboard): mark Linear write-back as beta and stop prompting for it by @beingzy in #277
• fix(ci): promote staging via PR, and email yi@ when a release publishes by @beingzy in #278
• feat: dynamic thoroughness — per-PR model and effort selection by @beingzy in #279
• feat: adopt the review strategy at runtime, surface it in onboard, restore the smart default by @beingzy in #280
• feat: stop working a PR once its latest verdict is APPROVE by @beingzy in #281
• fix: resolve conflicts for the whole life of a PR, not just before the first review by @beingzy in #283
• fix: land auto-fixes on the PR branch instead of always opening a follow-up PR by @beingzy in #286
• fix(ci): unblock the release pipeline and restore the production gate by @beingzy in #288
• fix: commit subjects credit the vendor that did the work, not always Claude by @beingzy in #285
• fix: address CR issues in fix: land auto-fixes on the PR branch instead of always opening a follow-up PR by @beingzy in #287
• fix: address CR issues in fix(ci): unblock the release pipeline and restore the production gate by @beingzy in #289
• fix: classify a failed clone by its cause, not by the token in its URL by @beingzy in #292
• fix: verify the reviewed sha against the repo before posting a verdict by @beingzy in #293
• docs: document the permission, webhook, and mutation model in one place by @beingzy in #294
• feat: add crosscheck adoption, measuring real usage from local logs by @beingzy in #295
• fix: conflict-resolve skipped every unattributed PR, and reported the no-op as success by @beingzy in #284
• fix: close an auto-fix PR when the PR it was cut from merges by @beingzy in #296
• fix: make the separate-fix-PR fallback work in the cases it exists for by @beingzy in #297
• chore: gitignore the Claude Code scratch directory by @beingzy in #301
• fix: do not fix a review against a commit that is no longer HEAD by @beingzy in #300
• fix: make Agent Skills actually reachable from Codex (0 activations in 244 runs) by @beingzy in #298
• chore: make npm run lint actually run, and fix what it found by @beingzy in #302
• refactor: remove unused mergePullRequest export by @beingzy in #303
• release: promote staging → main for production (v1.3.0) by @beingzy in #305

New Contributors

• @kay404 made their first contribution in #99
• @chababa9 made their first contribution in #100
• @rain2004-rr made their first contribution in #232

Full Changelog: v0.9.0...v1.3.0