@rspeicher I think the issue with the SHA is that the commit only exists in the forked source repo, while the note is rendered in the context of the target repo. This is why references work in MRs from GitLab BV, since our branches are commits are on gitlab-org/gitlab-ce anyway. I'm not sure about the nicest way to work around this; I'd rather not prefix every sha with username/gitlab-ce@.
As for missing cross-reference notes, I noticed this is as well yesterday, but I thought it may have been a fluke. Apparently not :(