# Hacker Bob v1.3.0 Release Notes

## Highlights

`v1.3.0` ships the post-v2 capability hypergraph: 8 capabilities, with C8 shipping substrate-only until explicit program policy permits live AI-driven disclosure speedruns. The release adds 26 MCP tools, 9 session artifacts, and 3 new hunter-brief slices while keeping the runtime load at 102 tools.

## Capabilities

- C1 cross-surface correlation via `surface_graph_slice`.
- C2 doc-vs-behavior delta hunting through schema ingest plus `bounty_run_doc_delta`.
- C3 diff-aware regression hunting through route extraction, symbol-surface indexing, and diff impact summaries.
- C4 multi-account differential checks through auth-profile fanout and divergence classification.
- C5 invariant fuzzing from audit findings using Foundry template generation and run persistence.
- C6 cross-target pattern memory through the findings index and `priors_slice`.
- C7 branching chain search through a content-addressed chain state tree.
- C8 live disclosure speedrun substrate only: NVD parsing and CVE-to-scope matching ship for offline triage, with no live dispatch wrapper.

## Tools, Artifacts, And Briefs

- Added 26 MCP tools across schema contracts, doc delta, auth differential, findings index, surface graph, chain tree, audit report ingest, invariant suggestions/runs, route extraction, symbol-surface indexing, diff impact, capability metrics, and capability evaluation.
- Added 9 artifacts: `schema-contracts.jsonl`, `doc-delta-results.json`, `auth-differential-results.json`, `findings-index.jsonl`, `surface-graph.jsonl`, `chain-tree.jsonl`, `audit-reports.jsonl`, `invariant-runs.jsonl`, and `symbol-surface-index.json`.
- Added 3 bounded hunter-brief slices: `schema_slice`, `priors_slice`, and `surface_graph_slice`.

## Guardrails

- Added regression coverage for representative web and smart-contract hunter brief size, with a 30k JSON budget for each profile.
- Added a v1/v2 `/bob-status` verification-panel structural assertion so new status prompts preserve both v2 replay metadata and the v1 fallback.
- Added an MCP-driven doc-delta integration test against a local HTTP fixture, including scope registration and hook invocation.
- Resolved final PR review blockers around prompt tool allowlists, doc-delta examples, response hashing, blocked telemetry accounting, CVE parsing, route extraction, artifact writes, secret-marker redaction, and graph neighbor validation.

## Install

```bash
npx -y hacker-bob@1.3.0 install /path/to/your/project
# or, via the adapter wrappers
npx -y hacker-bob-cc@1.3.0 install /path/to/your/project
npx -y hacker-bob-codex@1.3.0 install /path/to/your/project
```

After installing, fully restart your host CLI (Claude Code or Codex) in that project.

## Verification

- `npm run test:mcp` passes.
- `npm run test:prompts` passes.
- `git diff --check` passes.
- `npm test` passes.
- `node -e "require('./mcp/server.js')"` loads the runtime successfully.
- Fresh PR CI for `test (20)` and `test (22)` passed before merge.
