# Hacker Bob v1.3.3 Release Notes

## Highlights

`v1.3.3` hardens the session contracts that keep Bob runs resumable and debuggable. The release focuses on completion logging, canonical report writes, chain-attempt replay details, and audit-summary tolerance.

## Session Contract Hardening

- Web hunter prompts now require a final completion-status `bounty_log_technique_attempt` before `bounty_finalize_hunter_run`.
- Finalization retry guidance now points agents at the two durable contract failures that matter most: malformed handoffs and missing technique-attempt logs.
- Chain-builder prompts now require `steps[]` in every `bounty_write_chain_attempt` example so terminal `confirmed`, `denied`, `blocked`, and `not_applicable` outcomes preserve the replay or rejection path.
- Reporter prompts now require the consolidated canonical report at `~/bounty-agent-sessions/[domain]/report.md` before `bounty_report_written`, even when supporting per-finding files also exist.

## Runtime and Analytics

- `bounty_read_http_audit` now clamps oversized `limit` values to the configured summary cap instead of rejecting otherwise valid reads.
- Pipeline analytics now reports `report_pending_canonical_path` when a session has a SUBMIT grade but lacks the canonical `report.md`, including the expected path and a targeted next action.
- The canonical report-path action is included in release-bundle analytics so operators can distinguish "report not written yet" from "report written somewhere noncanonical."

## Verification

- `npm test`
- `npm run release:check`
- `npm run release:check:registry -- --allow-published`
