v1.13.1: eight corrections, and a patch number that undersells them

Released 2026-08-20. Cut the same day as v1.13.0, and not a hotfix for it: eight independent corrections, seven of them typed fix, including the one that stopped fleet workers from ending their turn to wait for something that would never wake them.

What we were trying to fix

The headline is #187. A phase-1 auto-dev worker is a background sub-agent: its final message is its report, and ending its turn ends its run. Workers were doing essentially all of the implementation work and then writing something like “I will pick this back up once it completes” and stopping. Nothing resumes them. What reached the orchestrator instead of a pull request number was the deferral itself, and the run had to be finished by hand. Two of three workers in one measured fleet run ended exactly that way.

The rest of the release is a batch of guards that were answering the wrong question. ci-wiring-check refused a suite nothing invoked, but happily passed a suite CI could not execute because its file was not executable (#195). merge-pr decided on a protection-only state rather than on measured divergence (#171). auto-dev tiered effort labels against a hardcoded small/medium/large vocabulary instead of the repository’s own (#213). tick-plan.sh compared its round-trip through a text-mode stdout rather than inside jq, which is exactly the kind of comparison that can pass on a body it has mangled (#199).

What we decided

Write the forbidden shape down, verbatim, and then test for it.

auto-dev now forbids the phase-1 worker wait explicitly and names the deferral signature: the exact sentences a worker writes when it is about to strand its own run. A worker that genuinely must wait waits inside one tool call, in a bounded loop, so the wait happens within the turn. There is a golden suite, tests/auto-dev-never-wait/, whose whole job is that the rule stays in the skill.

The guard fixes all took the same form as the release above and below them: make the check read the thing it claims to check. Executability for the wiring check, measured divergence for the merge decision, the repository’s own label vocabulary for tiering, and a structural comparison inside jq for the plan round-trip.

The Renovate gate learned to fail when its RE2 engine is missing (#130) rather than silently validating nothing, and section 8 of the skills suite started reading code instead of prose (#159).

What got cut

The turn and context budgets that would eventually bound a runaway worker are not here. This release only stops the worker that ends its turn early; it does nothing about the worker that runs 400 turns and spends more than four other sessions combined. That needed measurement first, and it landed in v2.0.0 as #270.

Nothing was pruned or rewritten in the effort-label tiering either. auto-dev reads whatever vocabulary the repository declares and refuses to guess when it cannot; teaching it to normalise foreign label sets was considered and left out.

What bit us

The version number. This is a patch release only because release-please reads Conventional Commit types, and seven of the eight commits here were fix (the eighth is a ci, which releases nothing on its own). So the story the semantic version tells is “we corrected v1.13.0”, and that is not what happened at all: v1.13.0 shipped setup-repo, and not one of these eight commits touches the skill (one adjusts its manifest data in passing, and that is the whole overlap). The batch is the backlog of correctness work that happened to clear on the same day.

It is worth saying plainly, because a reader walking this journal by version number will otherwise reconstruct a hotfix that never existed. The two defects setup-repo really did have surfaced next and landed in v1.14.0 (#198 and #200).

The other thing that bit us is the one #143 fixed: scripts that resolve caller paths without naming the base they resolve against. It reads as a documentation nit and it is the mechanism behind several of the wrong-checkout incidents in this era.