Prepare Crosscheck 0.3.0-rc.1 instructions and runtime

[jtcchan]

Crosscheck packages the approved verification skill and four references alongside its exact-target evidence runtime. It preserves legacy marketplace/skill identities, six runtime installer names, prior CLI aliases, immutable evidence binding and idempotent result publication.

Related to #1. Candidate: 0.3.0-rc.1.

Verified implementation and review

• Exact head: 76ce4f4c752c5c8d0c7edfe1861263e35714683a.
• 40 tests, six isolated runtime installation paths, canonical/legacy skill copy and overwrite checks, schema/metadata validation, and both plugin/skill validators passed.
• Actual isolated Codex installed-plugin discovery and cached instruction invocation were verified, with exact package hashes and read-only target evidence.
• Standalone Astra/high source review returned no P0–P2 findings; there are no unresolved GitHub inline review findings.
• All three CI jobs passed on this head, covering Python 3.11, 3.12 and 3.14.
• Release wheel/plugin archive and privacy-scanned committed bytes match the verified artifact hashes.

Owner-approved release scope

This is a Codex-first release. Claude installation/discovery is verified, but authenticated Claude model invocation remains unverified and is not a required release gate. This owner clarification supersedes the prior login blocker; it does not rewrite the historical BLOCKED report. All other required verification and publication gates remain intact.

Scope clarification.

Fresh independent read-only release verification passed all 20 required criteria under that explicitly amended contract. The PASS verdict was delivered and read back at this PR, the source issue and the original worker before merge. PR #2 is now merged, the merge tree matches the verified candidate, and main CI passes.

Published: Crosscheck 0.3.0-rc.1, with reviewed runtime wheel and plugin archive. The tag identifies the exact tested candidate. This is a prerelease, not stable 0.3.0.

Expected use: implementation → No Mistakes where applicable → fresh Crosscheck → owner-controlled merge or completed-issue closure. Later target changes invalidate PASS. This package release does not automatically install a fleet-wide hook, enable GitHub branch protection, activate live plugins, or prove universal workflow enforcement.

No production/client changes, private evidence uploads, package-registry publication or personal-repository archival are included.

[jtcchan]

Independent source review: changes required

What this work is for: make the independent QA agent a reliable final check that proves completed work, explains the result clearly, and prevents an outdated or incomplete result from clearing the gate.

What was checked: a fresh read-only reviewer examined every changed file and the screenshot fixture at this PR revision. All 20 tests, metadata/schema validation, and four isolated compatibility-installation paths passed. These checks found three problems not covered by the existing tests; the coordinating reviewer reproduced all three independently.

What needs fixing:

1. A target can change while the publisher searches existing comments, yet the publisher still posts and returns the old PASS. Add freshness checks around comment delivery and tests for a change during lookup or delivery.
2. Replacing the human-readable QA report does not invalidate its receipt. Bind and verify the exact report bytes, including after publication-state updates.
3. Verifying a valid BLOCKED receipt returns the FAIL exit code. Preserve the distinct missing-proof versus observed-defect outcomes.

What happens next: the original implementation worker is fixing these three bounded findings on this same PR. The revised work needs tests and another source review, canonical skill integration, then fresh independent process QA before release. No action is needed from the owner for these fixes.

Review evidence

• Reviewed head: 98a53424fe944db0dfdc2fe8f96f646bc031afdf
• Base: 5587ecd5028a680b506068c1c374419f74a9795a
• Severity: three P2 findings; no P0/P1 identified in the reviewed source.
• A single-destination target-change reproduction returned PASS/published after its revision changed.
• A replaced-report reproduction still returned successful receipt verification.
• A valid BLOCKED receipt evaluated with exit 2 but verified with exit 1.
• The synthetic 960×640 screenshot was visually inspected; its matching ordered trace was read. This is fixture inspection, not a fresh browser capture or process-QA pass.
• The source checkout remained unchanged during review. Full review and reproduction evidence is retained in task artifacts.

This is a binary-capable independent source review, not an Autoreview PASS or the final process-QA verdict. Autoreview stopped before invoking a reviewer because of the PNG fixture. The PR remains draft; no merge or release has occurred.

[jtcchan]

Crosscheck: BLOCKED

What this was for: Upgrade the independent QA agent so completed work must be backed by current evidence before it can move forward, with clearer checks for different kinds of work and a tested migration to Crosscheck.

What I checked: A fresh independent reviewer checked the completed candidate, including 40 repository tests, 51 additional failure cases, six installation paths, the packaged instructions, evidence and privacy rules, stale-result rejection, and reporting retries. Codex loaded and used the installed instructions successfully. Nineteen of twenty required criteria passed; no product defect was found in the checks performed.

Why this is blocked: Claude discovers the instructions, but a real authenticated Claude run is still missing. Installation success alone does not prove that compatibility check passed. This result does not clear the candidate for merge or release.

What happens next: The release owner completes Claude sign-in, then runs the isolated canonical and legacy instruction checks and obtains fresh final verification. No source repair is requested, and this informational report does not start another worker.

Evidence: Full report and checked evidence are retained in the task artifacts. Repository checks are available in the exact candidate's CI run. Private logs and local evidence have not been uploaded.

[jtcchan]

Controller review

Reviewed the exact candidate 76ce4f4c752c5c8d0c7edfe1861263e35714683a, its preserved legacy interfaces, instruction packaging, fail-closed evidence/publication contracts, and the completed standalone source-review receipt. The independent Astra/high source review found no P0–P2 defects. There are no unresolved inline findings; all three exact-head CI checks pass.

The release package hashes and all 17 privacy-scanned integration file hashes were rechecked against committed bytes. No source changes have been made after that review. Earlier runtime review findings were resolved before this candidate; this is not a new claim that unchanged code was retested by the controller.

The owner explicitly clarified this as Codex-first: Claude authenticated invocation remains unverified, not a required release gate. Final independent QA and exact-body publication readback remain required before merge/release. A package release does not prove fleet-wide automatic adoption.

This records the controller's review disposition, not a fabricated separate GitHub approval from the PR author's account.

[jtcchan]

Crosscheck: PASS

What this was for: turn Independent QA into Crosscheck, an independent final check that requires evidence before completed work can move forward.

What was checked: all 20 required checks passed. Fresh testing covered the shipped tests, the independent failure-case suite and new checks for misleading evidence, privacy, expired results and changed work. Installation, legacy compatibility, Codex instruction loading, reports and delivery behavior were also verified against the exact candidate.

Result: the Codex-first release candidate passes independent verification, with no required defects found. Authenticated Claude execution remains unverified and was explicitly excluded from required release acceptance by the owner before this run; it is not reported as passed. This supersedes the earlier blocked release assessment under the clarified scope, while preserving that report as history.

What happens next: the owner completes publication checks, merges the reviewed PR and publishes version 0.3.0-rc.1. No action is needed from a person. This is a package release, not proof that automatic Crosscheck enforcement is already enabled across every project. The original implementation worker should not start new work from this informational notice.

Evidence: exact candidate 76ce4f4c752c5c8d0c7edfe1861263e35714683a; passing CI; owner-approved scope. Full evidence is retained in the task artifacts. Only this reviewed summary is published; raw evidence stays private.