phaedo-mcp 0.2.2 → 0.3.1

package/NOTICE

@@ -0,0 +1,17 @@
+Phaedo
+Copyright 2026 Phaedo Labs, Inc.
+
+This product includes software developed by Phaedo Labs, Inc. (https://phaedo.so),
+licensed under the Apache License, Version 2.0.
+
+"Phaedo" and the Phaedo logo are trademarks of Phaedo Labs, Inc. The Apache License,
+Version 2.0 grants no trademark rights (Apache-2.0 §6); see TRADEMARKS for the brand
+policy and permitted nominative use.
+
+----------------------------------------------------------------------
+Third-party components (not redistributed in this package)
+----------------------------------------------------------------------
+The reference browser extension vendors @mlc-ai/web-llm (Apache-2.0). That bundle
+is NOT included in this npm package or the public repository (it is a gitignored
+build artifact). If/when the extension is distributed, the @mlc-ai/web-llm
+LICENSE and NOTICE travel with it.

package/README.md

@@ -1,11 +1,98 @@
-# Phaedo MCP server — Phase 1 (push injection)
+# Phaedo MCP server (`phaedo-mcp`)
 
-A local [MCP](https://modelcontextprotocol.io) server that exposes your Phaedo
-cognitive-fingerprint **projection** to any MCP client (Claude Desktop, Claude
-Code, Cursor, agent frameworks) — so the assistant responds in your style
-without the Chrome extension. One integration, every MCP client.
+Phaedo learns how you write, work and decide, and keeps that profile on your phone.
+This server lets your AI apps use it: Claude Desktop, Claude Code, Cursor, and any
+other app that supports [MCP](https://modelcontextprotocol.io). With it, they can:
 
-Implements `docs/protocol/mcp-binding.md` §3.1:
+- **Answer the way you like** — your preferred length, tone and format, without
+  you repeating it in every chat.
+- **Check with you before acting** — an AI agent asks Phaedo whether you'd want it
+  to go ahead. When it's unsure, your phone gets an approve / deny card.
+- **Learn from your answers** — each approve or deny teaches it how you want work
+  handled when you're not watching.
+- **Get your signature for purchases** — you sign a spending permission on your
+  phone with Face ID; the agent never holds the key.
+
+Your profile comes from your phone encrypted. The copy kept on this computer, for
+when your phone is offline, is encrypted too.
+
+## What you need
+
+1. **The Phaedo phone app.** Your profile lives there. The app isn't open to the
+   public yet — [phaedo.so](https://phaedo.so) has a link to hear when it is.
+2. **Node.js**, free from [nodejs.org](https://nodejs.org) (the LTS button).
+
+Without the phone app there is no profile, and the server says so plainly rather
+than guessing. You can still try Phaedo with a made-up example profile.
+
+## Try it with the example profile (no phone needed)
+
+This loads a made-up person's profile, so you can see what Phaedo adds before you
+have your own.
+
+**Claude Code** — run this in Terminal (it applies to all your projects):
+
+```bash
+claude mcp add -s user phaedo -e PHAEDO_FINGERPRINT=sample -- npx -y phaedo-mcp
+```
+
+**Claude Desktop** — open Settings → Developer → Edit Config, add the `phaedo`
+entry below inside `mcpServers`, save, then quit and reopen Claude Desktop:
+
+```json
+{
+  "mcpServers": {
+    "phaedo": {
+      "command": "npx",
+      "args": ["-y", "phaedo-mcp"],
+      "env": { "PHAEDO_FINGERPRINT": "sample" }
+    }
+  }
+}
+```
+
+If Claude Desktop reports that the server failed to start, it couldn't find
+`npx`. Replace `"npx"` with the full path that this prints:
+
+```bash
+which npx
+```
+
+Then start a new chat and ask: *"Load my Phaedo profile."* To stop using the
+example, delete the `env` line in Claude Desktop, or in Claude Code run
+`claude mcp remove -s user phaedo` and add it again without `-e …`. The server
+will then tell you there's no profile until you pair your phone.
+
+## Use your own profile (with the phone app)
+
+1. **Get this folder.** On [the GitHub page](https://github.com/phaedo-labs/phaedo-mcp),
+   click **Code → Download ZIP**, unzip it, and open the `mcp` folder inside.
+2. **Run the installer.**
+   - macOS: double-click **`installers/macos/Install Phaedo MCP.command`**. If macOS
+     says it can't be opened, right-click it and choose **Open**.
+   - Windows: double-click **`installers/windows/Install Phaedo MCP.bat`**.
+   - Linux: run `bash installers/linux/install-phaedo-mcp.sh`.
+
+   It adds Phaedo to Claude Desktop, Cursor and Claude Code — keeping your other
+   settings, and backing each file up first — then starts pairing.
+3. **Pair with your phone.** Open Phaedo on your phone. On the same Wi-Fi, approve
+   **"Phaedo MCP Server"** and check that the code matches the one in Terminal.
+   On a different network, tap **Pair with code** and type the code Terminal shows.
+4. **Quit and reopen your AI apps**, start a new chat, and ask: *"Load my Phaedo
+   profile."*
+
+You can disconnect this computer at any time from the **Agents** screen on your
+phone.
+
+---
+
+## Reference
+
+Everything below is for developers: the full tool list, how the profile is
+loaded, and the test suite.
+
+The server implements the MCP binding of the Anamnesis protocol
+(`docs/protocol/mcp-binding.md` §3.1):
 
 | Surface | Name | Returns |
 |---|---|---|
@@ -17,12 +104,24 @@ Implements `docs/protocol/mcp-binding.md` §3.1:
 | tool | `phaedo_escalate` | run the consult and, on a blocking signal (`escalate`, or a consequential `clarify`), wake the subject's paired device for a live **approve / deny / modify**; returns a `request_id` (non-blocking). Safe default on no answer: **hold**. |
 | tool | `phaedo_escalation_status` | poll an escalation by `request_id`; on resolution records the subject's live decision as the §10.6 outcome automatically (a real-time approve/deny is the strongest act-as-me signal). |
 | tool | `phaedo_record_outcome` | §10.6 — record what the SUBJECT decided about a consulted action (`approved`/`rejected`/`modified`/`unknown`). A `rejected`/`modified` outcome teaches the **act-as-me** channel (how the user wants delegated work handled). |
+| tool | `phaedo_sign_mandate` | §8.3 — ask the subject to **sign** an AP2 Intent Mandate built from their standing authorizations (a verifiable payment credential). Deposits the request and returns a `request_id` + the unsigned mandate (non-blocking). The subject signs on their phone in the Secure Enclave, or declines. |
+| tool | `phaedo_sign_status` | poll a `phaedo_sign_mandate` request by `request_id` (+ the returned mandate); returns the mandate carrying a **verified** signature once signed, `refused` if declined, or pending/expired. The signature is checked against the subject's published signing key before it is returned. |
 
 The projection is rendered by the **same** `context-block.js` the extension
 injects, so MCP injection is byte-identical to web injection.
 
 ## Status
 
+The phases below track the **fingerprint source** (how the server obtains the
+fingerprint). The consultation, real-time escalation, act-as-me / delegation, and
+receipts-audit surfaces (the tools table above) shipped on top of these across the
+**0.2.x** line, and the §8.3 signing pair in **0.3.0** — see `CHANGELOG.md`.
+
+> **Install 0.3.0 or later.** 0.2.0, 0.2.1 and 0.2.2 were published with three
+> modules missing from the package, so they exit with `ERR_MODULE_NOT_FOUND`
+> instead of starting. 0.3.0 is the first working release since 0.1.1, and
+> `test-package-closure.mjs` now boots the packed tarball in CI.
+
 - **Phase 1a (this cut):** reads the fingerprint from a local JSON file (see
   *Fingerprint source*). Lets injection work in a real client today, no crypto.
 - **Phase 1b-i (done):** the spec-faithful key boundary — authorize → pull
@@ -50,8 +149,10 @@ injects, so MCP injection is byte-identical to web injection.
   `../docs/roadmap/mcp-revocable-approval-plan.md`. Phone-gated unlock stays a
   deferred enterprise mode behind a config flag.
 
-**Injection-only.** MCP never returns the conversation, so there is **no
-capture** here (binding §5) — your fingerprint does not learn from MCP sessions.
+**No conversation capture.** MCP never returns the conversation, so your
+fingerprint does not learn from MCP sessions (binding §5). (Consultation,
+escalation, and `phaedo_record_outcome` shape and record *decisions*, but none
+capture conversation text into the fingerprint.)
 Local **stdio** only; **standard** mode only (enhanced-privacy/Stained-Glass and
 remote HTTP/SSE are out of this cut).
 
@@ -112,9 +213,13 @@ foregrounded/reachable at the configured `endpoint`. *(You can still hand-copy
 `pairing.sample.json` → `pairing.json` from the extension's `phaedo_local_pairing`
 if you prefer.)*
 
-**Phase 1a — local JSON (fallback / demo).** With no pairing record, reads a
-**vault payload** from `PHAEDO_FINGERPRINT`, then `mcp/fingerprint.json`, then
-the shipped `mcp/sample-fingerprint.json` (so it runs out of the box):
+**Phase 1a — local JSON.** With no pairing record, reads a **vault payload**
+from `PHAEDO_FINGERPRINT` (a path, or the word `sample` for the shipped
+`mcp/sample-fingerprint.json`), then `mcp/fingerprint.json`. With neither, there
+is **no profile**: every tool returns a plain-language `decryption_failed` error
+saying so. The sample is never served unless asked for by name — until 0.3.1 it
+was the silent fallback, so a fresh `npx phaedo-mcp` injected a made-up person's
+style without saying so. The file looks like this:
 ```json
 {
   "phaedo_fingerprint": { "layers": { ... }, "fingerprint_id": "...", "persona_strength": 0.6 },
@@ -181,6 +286,60 @@ fully automatic depending on the client:
 
   Every chat in that project then injects automatically.
 
+### Capture from Claude Code / Cowork (optional)
+
+`npm run setup:code-hook` also installs a **SessionEnd** hook that reads the just-ended
+transcript locally, derives behavioral signals (deterministic pattern detectors), and
+deposits an encrypted **signal delta** to the owner — so your Claude Code / Cowork usage
+feeds the fingerprint, not just the browser. The transcript is counted and **discarded**
+(nothing but signal names + integers leaves the machine); a paired phone/extension drains
+and merges it.
+
+Optionally enrich the deterministic detectors with a **local model** (opt-in) — it
+classifies the messages the regexes miss, against the same taxonomy, and feeds the same
+counters (so re-fires stay idempotent). Any **Ollama / OpenAI-compatible** endpoint works:
+
+```
+ollama pull llama3.1:8b          # or any local model
+npm run setup:capture-model -- llama3.1:8b     # writes ~/.phaedo-mcp/capture-model.json
+npm run setup:capture-model -- off             # turn it back off
+```
+
+Point it elsewhere with `--capture-url <url>` (default `http://localhost:11434`). It's
+fail-safe: endpoint down/slow/garbage → the hook silently falls back to the deterministic
+detectors, and a model call can never break or stall a session (30s budget, hook always
+exits 0). Prefer the `setup:capture-model` config file over an env var — the file reaches
+Dock-launched Claude Desktop, a shell `export` does not.
+
+### Consult before shipping, from Claude Code (`hooks/pre-ship.mjs`)
+
+`npm run setup:code-hook` also installs a **ship hook** on Bash (PreToolUse,
+PermissionRequest, PostToolUse, PostToolUseFailure). Before an agent merges a PR
+(`gh pr merge`), deploys (`fly deploy`), builds or submits a phone app (`eas build` /
+`eas submit`) or pushes straight to `main`, the hook runs a full `phaedo_consult` on it
+(`ship-actions.js` names these; every other command is ignored in ~50 ms) and writes a
+§10.6 receipt, `agent_id: claude-code/ship-hook`.
+
+- **It only ever adds friction.** It never returns `allow`. A permissive answer leaves
+  Claude Code's own permission flow untouched; `escalate` / `clarify` / `decline` returns
+  `ask`, so the action comes to you with one plain line saying why.
+- **Outcomes are yours, never inferred.** The hook records `approved` only when it has
+  evidence you were asked: Claude Code fired PermissionRequest for that command, and the
+  command then ran. That holds in every mode except auto / dontAsk, where no person
+  answers. Decline and the agent records `rejected` (Claude Code fires no hook for a
+  decline). No prompt shown, nothing recorded; the agent is told so, and records your
+  reaction only if you give one.
+- **What a merge changes.** Before `gh pr merge` the hook reads the PR from GitHub (read-only):
+  failing or unfinished checks, a large diff (> 1,000 code lines or > 20 files), or a sensitive
+  path (CI/deploy config, auth/crypto/secrets by name, or your repo's `.phaedo-sensitive` list,
+  read from the base branch) make it high-stakes. It can raise the stakes, never lower them.
+- **Stale profile.** It reads the at-rest profile cache (so it never pings your phone);
+  when that copy is over 14 days old the agent tells you once a day, with the refresh:
+  `npm run pull` and approve on the phone.
+- **See what it has done:** `npm run ship-readout` (`-- --days 90` to widen).
+- **Fail-safe:** any error, timeout (12 s) or unusable profile → no output, the command
+  runs as if the hook weren't there.
+
 ## Consult at decision points (`phaedo_consult`, §10)
 
 Beyond injecting style, an agent can **ask the fingerprint how the user's pattern
@@ -254,17 +413,21 @@ returns a §10.3 signal. Any failure/timeout/parse error **falls back to the rul
 engine**, so the model can only improve on, never break, the floor (and a missing
 model never breaks consultation). The §10.4 boundary is enforced on parse.
 
-The **installer turns this on automatically**: it probes local Ollama and writes
-`PHAEDO_CONSULT_MODEL` into each client's server entry (picking an installed general
-model, else defaulting to `llama3.1:8b`). Toggle it at install time:
+The judge is **off by default** — the rule engine answers. Measured 2026-10-18 against
+one cached profile, `llama3.1:8b` answered a $12k irreversible payment `clarify 0.9` on
+one run and `proceed_with_note 0.9` on the next, where the rules say `clarify` every
+time. Opt in at install time once a model has earned it:
 
 ```bash
-npm run setup                              # model judge ON (auto-detect Ollama)
-node install.mjs --consult-model qwen2.5:7b   # pin a specific model
+npm run setup                              # model judge OFF (rule engine) — the default
+node install.mjs --model-judge             # ON, auto-detect a local Ollama chat model
+node install.mjs --consult-model qwen2.5:7b   # ON, pinned
 node install.mjs --consult-url http://localhost:11434   # custom endpoint
-node install.mjs --no-model-judge          # rule engine only
 ```
 
+Auto-detect prefers `llama3.1:8b` when installed and never picks an extraction
+fine-tune or an embedding model (`nomic-embed-text` cannot answer a chat prompt).
+
 Use a **general** chat model (NOT the extraction fine-tune). To run it: `ollama
 pull llama3.1:8b`. Raw env (if configuring a client by hand):
 `PHAEDO_CONSULT_MODEL`, `PHAEDO_CONSULT_MODEL_URL`, `PHAEDO_CONSULT_API_KEY`
@@ -303,7 +466,7 @@ The installer writes exactly this. The minimal **paired** entry needs no `env`
   "mcpServers": {
     "phaedo": {
       "command": "/absolute/path/to/node",
-      "args": ["/Users/galavoxx/phaedo/mcp/server.js"]
+      "args": ["/absolute/path/to/phaedo/mcp/server.js"]
     }
   }
 }
@@ -315,5 +478,5 @@ chat and prepend the returned `projection`.
 
 **Claude Code** — `.mcp.json` in a project, or:
 ```bash
-claude mcp add phaedo -- /absolute/path/to/node /Users/galavoxx/phaedo/mcp/server.js
+claude mcp add phaedo -- /absolute/path/to/node /absolute/path/to/phaedo/mcp/server.js
 ```

package/action-binding.js

@@ -0,0 +1,82 @@
+// §10.2 `action_binding` — tying a consultation to the call it claims to describe.
+//
+// THE PROBLEM. Every field the resolver decides on lives in `action_descriptor`,
+// and every one of them is authored by the agent being gated: domain, magnitude,
+// reversible, amount, summary. A standing authorization like
+//
+//     { match: { domains: ["writing"], magnitude_max: "medium", reversible: true },
+//       effect: "autoproceed" }
+//
+// therefore fires on whatever the agent SAYS it is doing, not on what it is doing.
+// A buggy, prompt-injected, or hostile agent auto-proceeds on anything by
+// describing it as low-magnitude reversible writing. The escalation rail inherits
+// the same assumption: the subject approves the agent's prose summary.
+//
+// This is a known 2026 vulnerability class, not a hypothetical — agents requesting
+// approval on a shown path while operating on the resolved target (CWE-61 symlink
+// following + CWE-451 UI misrepresentation) produced CVE-2026-12958 (Amazon) and
+// CVE-2026-50549 (Cursor), among others.
+//
+// WHAT THIS DOES, AND WHAT IT DOES NOT. A binding does NOT make the descriptor
+// truthful — nothing at this layer can, short of the resolver executing the call
+// itself. What it does:
+//
+//   1. makes a mismatch PROVABLE after the fact (the receipt records the exact
+//      tool and a hash of its arguments, so the agent's own logs can be checked
+//      against what the oracle was told),
+//   2. gives the subject the REAL call on the escalation card, next to the
+//      agent's description of it, and
+//   3. lets an authored authorization demand a binding before it will RELAX
+//      anything (§10.5 `require_binding`), so the blast radius of a fabricated
+//      descriptor is bounded by what the subject explicitly opted into.
+//
+// The hash is over the RFC 8785 canonical form of the arguments, so an agent and
+// an auditor computing it independently agree byte-for-byte. Arguments themselves
+// are NEVER carried — only a digest, plus an optional short human preview that the
+// subject sees on the escalation sheet.
+//
+// PURE: no I/O, no globals, no crypto beyond the hash the caller injects. Shared by
+// the resolver (mcp/consult-core.js), the receipt writer (mcp/receipts.js) and the
+// escalation payload builder (mcp/escalation.js) so the three cannot drift.
+
+import { PhaedoError } from './errors.js';
+
+// A preview is for a human glance on a phone sheet, not a serialization format.
+export const PREVIEW_MAX = 200;
+export const TOOL_NAME_MAX = 120;
+// A hex or base64url digest. Bounded so a malformed field can't bloat the receipt
+// store or the (encrypted) escalation payload.
+const HASH_RE = /^[A-Za-z0-9_-]{16,128}$/;
+
+const isObj = (x) => x !== null && typeof x === 'object' && !Array.isArray(x);
+const clip = (s, n) => String(s).replace(/\s+/g, ' ').trim().slice(0, n);
+
+// Parse + validate §10.2 `action_binding`. Returns the normalized binding, or null
+// when absent. THROWS `request_malformed` when present but structurally wrong — a
+// half-formed binding is worse than none, because a caller could believe it is
+// bound when the resolver treats it as unbound.
+export function normalizeActionBinding(raw) {
+  if (raw == null) return null;
+  if (!isObj(raw)) throw new PhaedoError('request_malformed', 'action_binding must be an object.');
+
+  const toolName = typeof raw.tool_name === 'string' ? raw.tool_name.trim() : '';
+  if (!toolName) throw new PhaedoError('request_malformed', 'action_binding.tool_name is required and must be a non-empty string.');
+  if (toolName.length > TOOL_NAME_MAX) throw new PhaedoError('request_malformed', `action_binding.tool_name exceeds ${TOOL_NAME_MAX} characters.`);
+
+  const hash = typeof raw.arguments_hash === 'string' ? raw.arguments_hash.trim() : '';
+  if (!hash) throw new PhaedoError('request_malformed', 'action_binding.arguments_hash is required and must be a non-empty string.');
+  if (!HASH_RE.test(hash)) throw new PhaedoError('request_malformed', 'action_binding.arguments_hash must be a hex or base64url digest (16–128 chars).');
+
+  const out = { tool_name: clip(toolName, TOOL_NAME_MAX), arguments_hash: hash };
+  if (typeof raw.arguments_preview === 'string' && raw.arguments_preview.trim()) {
+    out.arguments_preview = clip(raw.arguments_preview, PREVIEW_MAX);
+  }
+  return out;
+}
+
+// Is this request bound to a concrete call? The single predicate every consumer
+// asks, so "bound" means exactly one thing across the resolver, the policy engine,
+// the receipt and the escalation card.
+export function isBound(binding) {
+  return !!(binding && binding.tool_name && binding.arguments_hash);
+}

package/agreement.js

@@ -77,13 +77,97 @@ export function computeAgreement(receipts, { windowDays = DEFAULT_WINDOW_DAYS, n
   };
 }
 
+// ── Split by resolver revision (precedent track Phase 1b) ─────────────────────
+// Which engine answered a receipt: the `resolverRevision` driver the consult stamped (the
+// rules' RESOLVER_REVISION, or `judge:<model>`). A matched pre-flight is a standing rule
+// answering, not the inferred path. Anything else predates the stamp (2026-10-20) or carried
+// no inferred prediction (an abstain) — "not recorded", never guessed.
+export const NOT_RECORDED = 'not recorded';
+export function revisionOf(r) {
+  const d = Array.isArray(r?.drivers) ? r.drivers.find((x) => x?.cue === 'resolverRevision') : null;
+  if (d && typeof d.value === 'string' && d.value) return d.value;
+  if (r?.via === 'phaedo_check_authorization') return 'standing rule (pre-flight)';
+  return NOT_RECORDED;
+}
+
+/**
+ * (receipts, { windowDays, now }) -> { [revision]: overall-bucket }, so a behaviour change
+ * shows up as two rates instead of one blurred one. Same scoring as computeAgreement.
+ */
+export function computeAgreementByRevision(receipts, { windowDays = DEFAULT_WINDOW_DAYS, now = Date.now() } = {}) {
+  const groups = new Map();
+  for (const r of Array.isArray(receipts) ? receipts : []) {
+    const k = revisionOf(r);
+    if (!groups.has(k)) groups.set(k, []);
+    groups.get(k).push(r);
+  }
+  const out = {};
+  for (const [k, rs] of groups) {
+    const rep = computeAgreement(rs, { windowDays, now });
+    if (rep.window.in_window > 0) out[k] = rep.overall;
+  }
+  return out;
+}
+
+// ── The transportable summary (receipts digest → phone) ───────────────────────
+// `computeAgreement` is the full local report; this is the bounded slice that rides
+// the `agent_to_phone` receipts digest so the subject can see how well their oracle
+// is tracking them, per domain, without opening a terminal.
+//
+// It is derived ENTIRELY from the subject's own receipts and only ever travels
+// between the subject's own devices (ciphertext over the relay), so it raises no
+// §10.4 question — but it still carries no layer content, no rationale, and no
+// `drivers`: counts and a rate, nothing else.
+//
+// Bounded on purpose (the digest is a last-write-wins payload, so it must not grow
+// without limit): unscored domains are dropped (a domain with nothing scored says
+// nothing), the rest are ranked by `scored` and capped. Ties break by name so the
+// payload is DETERMINISTIC — an unstable key order would make every deposit look
+// like a change.
+export const DIGEST_DOMAIN_CAP = 8;
+
+const slimBucket = (b) => ({
+  rate: b.rate,
+  scored: b.scored,
+  agreements: b.agreements,
+  disagreements: b.disagreements,
+  non_directional: b.non_directional,
+  awaiting_user_action: b.awaiting_user_action,
+});
+
+// (receipts, { windowDays, now, domainCap }) -> { window_days, overall, domains }
+export function agreementDigest(receipts, { windowDays = DEFAULT_WINDOW_DAYS, now = Date.now(), domainCap = DIGEST_DOMAIN_CAP } = {}) {
+  const report = computeAgreement(receipts, { windowDays, now });
+  const domains = {};
+  Object.entries(report.domains)
+    .filter(([, b]) => b.scored > 0)
+    .sort((a, b) => (b[1].scored - a[1].scored) || a[0].localeCompare(b[0]))
+    .slice(0, Math.max(0, domainCap))
+    .forEach(([name, b]) => { domains[name] = slimBucket(b); });
+  return { window_days: windowDays, overall: slimBucket(report.overall), domains };
+}
+
 // ── Dev CLI: `node agreement.js` / `npm run agreement` — local readout only ───
 // Decrypts the local receipt store with the local key; nothing leaves the device.
 // NOT product UX and NOT fed back into deference (see header).
 if (process.argv[1] && process.argv[1].endsWith('agreement.js')) {
-  const days = Number(process.argv[2]) || DEFAULT_WINDOW_DAYS;
+  const args = process.argv.slice(2);
+  const byRevision = args.includes('--by-revision');
+  const days = Number(args.find((a) => /^\d+$/.test(a))) || DEFAULT_WINDOW_DAYS;
   Promise.all([import('./receipts.js'), import('./cache.js')]).then(async ([{ readReceipts }, { defaultStateDir }]) => {
-    const report = computeAgreement(await readReceipts(defaultStateDir()), { windowDays: days });
+    const receipts = await readReceipts(defaultStateDir());
+    if (byRevision) {
+      const split = computeAgreementByRevision(receipts, { windowDays: days });
+      console.log(`Agreement by rule-engine version — last ${days}d\n`);
+      const names = Object.keys(split).sort((a, b) => (a === NOT_RECORDED) - (b === NOT_RECORDED) || a.localeCompare(b));
+      if (!names.length) console.log('No receipts in the window.');
+      for (const k of names) {
+        const b = split[k];
+        console.log(`${k.padEnd(34)} rate ${b.rate === null ? '  —  ' : (b.rate * 100).toFixed(1) + '%'}  (${b.agreements}✓ ${b.disagreements}✗ of ${b.scored} scored · ${b.non_directional} non-directional · ${b.awaiting_user_action} awaiting)`);
+      }
+      return;
+    }
+    const report = computeAgreement(receipts, { windowDays: days });
     const { overall: o, window: w } = report;
     console.log(`Agreement over the last ${w.days}d — ${w.in_window}/${w.total_receipts} receipts in window\n`);
     const line = (label, b) =>