# Hacker Bob v1.1.3 Release Notes

## Highlights

`v1.1.3` turns `/bob-debug` into a stronger after-session QA gate for policy and refusal failures. It still reviews the normal Bob pipeline after every session, but when telemetry or `--deep` transcript review shows a policy/refusal stuck signal, it can now run bounded local replay diagnostics and suggest a prompt change for the operator to review.

The release also adds structured chain-attempt state. Chain building now writes machine-readable attempts through MCP, and verifiers, graders, reporters, analytics, and hooks consume those attempts instead of relying on markdown chain notes.

## Policy Replay

The new `testing/policy-replay/` harness is included in the package. It supports:

- `replay.mjs` for one-case or one-transcript replay using the Claude Agent SDK and local Claude OAuth.
- `tune.mjs` for bounded prompt guardrail trials that report a `recommended_prompt_change`.
- `bench.mjs` for comparing prompt candidates across retained replay fixtures.
- CI-safe dry-run and schema tests that do not call Claude.

`/bob-debug` may run the replay/tune scripts when it identifies a clear policy/refusal failure and can locate the relevant transcript window. It does not edit prompts, touch targets, or mutate Bob session state.

## Chain Evidence

This release adds durable chain-attempt artifacts and MCP tools:

- `bounty_write_chain_attempt`
- `bounty_read_chain_attempts`

The CHAIN phase records confirmed, denied, blocked, inconclusive, or not-applicable chain outcomes. Downstream VERIFY, GRADE, REPORT, and analytics steps consume that structured evidence.

## Install

```bash
npx -y hacker-bob-cc@1.1.3 install /path/to/your/project
```

After installing, fully restart Claude Code in that project so the updated `/bob-debug`, `/bob-hunt`, and agent prompts reload.

## Verification

- `npm test` passes.
- `npm run release:check` passes.
- Canonical and alias package dry-runs include the expected files.
