v0.2.0

v0.2.0 — 2026-09-15

The release that measures itself. A new verb reports what packing a task is
worth with both arms measured, the corpus over bundlebox actually exercises
bundlebox, and five files that had grown past the point where a session reads a
region instead of a file are split.

Added

• bb bench — the ablation. The same task twice: BARE searches the tree for
  its terms and opens the top --cap files whole, PACKED is the one
  bb pinpoint prompt for it. Both arms are token counts over text on disk, so
  neither calls a model and two runs on one tree return the same number —
  asserted in CI and in bb selftest. A task that costs MORE packed than bare
  is printed in the table, not dropped. bb bench init derives a suite from the
  open findings that name a file; bench init and bench run are stages of the
  measure gear, so the number refreshes on the same tick that folds the ledger.
• The command centre reports it. Four stat cards, each tagged MEASURED or
  ESTIMATE so the two cannot be read as one kind of number, and two inline-SVG
  charts: bare against packed per task, and the share saved across every run. No
  CDN — a chart that needs a network is a blank rectangle on the box this page
  is designed for. New routes GET /health and GET /api/bench.
• An ambiguity ledger on every brief. bb pinpoint now states what the
  brief does NOT settle — no gate detected, nothing in the symbol tables
  matched, no region located, no evidence on file, a scope cut to fit, a
  statement too thin to locate anything — scored, with the reasons kept separate
  from the score. Stated, never filled in by guessing.
• anti-slop detector. Eight JS/TS patterns that discard evidence or pay a
  quadratic cost: adjacent eager filter/map, a reducer copying its
  accumulator per element, chained assertions, any in a contract, open
  dictionaries, mocked modules, Reflect escapes. One rule firing once is
  info and can never be promoted into work; three rules in one file is
  medium.
• A corpus over bundlebox itself. Twenty scenarios, fifty-five steps — the
  CLI's dry runs, the MCP handshake, the command centre's four routes, the
  bench's own determinism — committed and run in CI against a live command
  centre. Coverage 96.6%. A corpus persona can now declare excluded: a
  capability it must not run, with a reason, leaves the denominator instead of
  being an open gap forever.
• bb help is a table. Verb, effect, what it does, grouped by the question
  each group answers. The effect column reads spends / writes --apply /
  records / reads, so which two verbs can cost money is read rather than
  remembered.
• docs/prior-art.md: seven projects read, what came back and what did not.

Fixed

• bb cron install wrote a line that ran nothing. No --apply, so the
  unattended worker reported would-run every thirty minutes and produced
  nothing indefinitely while looking installed. It carries the flag now, and
  refuses to install if the gear reaches a verb that can spend — checked against
  the gear spec rather than assumed. A selftest holds both halves.
• The coverage matcher compared the first token, so one step running
  bb scan reported all twenty-three bb * capabilities as covered and a
  one-step corpus read as 100%. It matches the whole command, understands
  node bin/bb.js scan as the same capability as the documented bb scan,
  treats a declared --apply as significant, and matches each segment of a
  shell line.
• bb genesis re-seeding a corpus rewrote persona.json from a fixed field
  list and silently dropped every key not on it.
• bb simulate merged findings only when a run produced some, so findings
  from a run against a service that was down could never be closed by a clean
  run. A clean run is the evidence that closes them.
• The simulations frame read every run ever stored, so one bad run poisoned
  simulation-error-pct permanently. It reads the latest run per profile; the
  history stays on disk for bb simulate show.
• A deliberate 404 probe was reported as a phantom call against an undeclared
  route. A step asserting absence is not evidence of a missing route.
• World derivation extracted a formula (projected = overhead + ...), a cd
  and prose lines from fenced blocks as command capabilities, each of which
  stayed permanently uncovered.
• .gitignore excluded directory contents rather than directories, because git
  cannot re-include a path inside an excluded directory — written the old way,
  the corpus would never have shipped.

Changed

• Five files past a third of one session's payload are split along the seams
  they already declared, with each entry point kept as a barrel so no caller
  outside the directory changed: kernel/src/scenario.rs →
  scenario/{expect,steps}.rs; src/snapgen/tables.js →
  {walk,symbols,views,sources}.js; src/git/index.js →
  {repo,commit,forge}.js; src/pipeline/runner.js → {facts,report}.js with
  runGear split into decide() and execute(); src/genesis/index.js →
  {world,packs}.js. src/commandcenter/page.js and
  src/designlabs/scaffold.js crossed the same bar and are split too.
• The workspace's runbook service is the command centre, which answers
  /health; bb runbook up starts it and the smoke profile runs against it.
• CI runs the corpus, the simulation, the bench determinism check and the evals.

Measured

225 node tests, 23 expert tests, 25 selftest checks, 0 lint errors, 0 open
high-severity findings, 10 of 10 pipeline stages holding.

On this tree, twelve bench tasks: 700.3k bare against 34.6k packed. That
percentage is a property of the tree as much as of the tool, which is why
bundlebox-projects/tokenlab sweeps it across three tree sizes and three read
budgets and reports 78%–97%. What holds across all nine of those rows is the
middle column: the packed arm is constant. A pinpoint prompt costs what the task
costs; the bare arm pays for the repository.