obey-cli 0.1.0__py3-none-any.whl

obey_cli/commands.py

@@ -0,0 +1,676 @@
+"""Implementations of the obey subcommands (argument parsing lives in cli.py)."""
+
+from __future__ import annotations
+
+import argparse
+import datetime as _dt
+import json
+import os
+import sys
+import tempfile
+from pathlib import Path
+from typing import Any
+
+from obey_cli import config as cfg
+
+DEFAULT_IMAGE = "obey-sandbox:0.1.0"
+
+
+def out(text: str) -> None:
+    print(text, flush=True)
+
+
+def err(text: str) -> None:
+    print(f"obey: {text}", file=sys.stderr, flush=True)
+
+
+def _root(args: argparse.Namespace) -> Path:
+    return Path(args.repo).resolve()
+
+
+def _load(args: argparse.Namespace) -> tuple[Path, dict[str, Any]]:
+    root = _root(args)
+    return root, cfg.load(root / args.config)
+
+
+# --------------------------------------------------------------------------------------------- probe
+
+
+def cmd_probe(args: argparse.Namespace) -> int:
+    from obey_cli.probes.facts import detect
+    from obey_cli.probes.templates import probes_for
+
+    root, config = _load(args)
+    facts = detect(root)
+    added = 0
+    for rule in config["rules"]:
+        if rule.get("probes") and not args.regenerate:
+            continue
+        probes = probes_for(rule, facts)
+        if probes:
+            rule["probes"] = probes
+            added += 1
+    cfg.save(root / args.config, config)
+    active = [r for r in config["rules"] if r["status"] == "active"]
+    with_probes = [r for r in active if r.get("probes")]
+    out(
+        f"probes for {len(with_probes)} of {len(active)} active rules ({added} new); language {facts.language}, "
+        f"package manager {facts.package_manager or 'unknown'}, test command {facts.test_command or 'unknown'}"
+    )
+    for r in active:
+        if not r.get("probes"):
+            out(f"  no template fits: {r['id']} ({r['checker']['type']}); add a probe by hand in {args.config}")
+    return 0
+
+
+# --------------------------------------------------------------------------------------------- run
+
+
+def _key() -> str:
+    return os.environ.get("OBEY_API_KEY") or os.environ.get("OPENROUTER_API_KEY") or ""
+
+
+def _rule_scores_from_report(report: dict[str, Any]) -> list[Any]:
+    from obey_cli.score import RuleScore
+
+    fields = RuleScore.__dataclass_fields__
+    return [RuleScore(**{k: v for k, v in s.items() if k in fields}) for s in report.get("scores", [])]
+
+
+def _enforcement_files(rules: list[dict[str, Any]], targets: list[str]) -> tuple[dict[str, str], dict[str, str]]:
+    """Contents of the enforcement files obey would write for `rules`, plus git hook shims."""
+    from obey_cli.enforce import plan_enforce
+
+    with tempfile.TemporaryDirectory() as tmp:
+        plan = plan_enforce(Path(tmp), rules, targets)
+        files = {rel: after for rel, (_, after) in plan.changes.items() if after is not None}
+    hooks = {}
+    if "precommit" in targets:
+        shim = '#!/bin/sh\nexec python3 "$(git rev-parse --show-toplevel)/.obey/pre-commit" "$@"\n'
+        hooks = {"pre-commit": shim, "commit-msg": shim}
+    return files, hooks
+
+
+def cmd_run(args: argparse.Namespace) -> int:
+    from obey_cli.report import badge, build_report
+    from obey_cli.runner import agents
+    from obey_cli.runner.core import RunSpec, execute
+    from obey_cli.runner.ledger import Ledger
+    from obey_cli.runner.orchestrate import estimate, execute_all, model_price, outcomes, plan_runs
+    from obey_cli.score import score_outcomes
+
+    root, config = _load(args)
+    agent_cfg = (config.get("agents") or [{}])[0]
+    agent_name = args.agent or agent_cfg.get("agent") or "claude-code"
+    model = args.model or agent_cfg.get("model")
+    if not model:
+        err(
+            "choose a model with --model (an OpenRouter model id such as anthropic/claude-haiku-5.5) "
+            "or set agents: [{agent, model}] in obey.yaml"
+        )
+        return 2
+    adapter = agents.get(agent_name)
+    rules = [r for r in config["rules"] if r["status"] == "active" and r.get("probes")]
+    if args.rules:
+        wanted = set(args.rules.split(","))
+        rules = [r for r in rules if r["id"] in wanted]
+    if args.unsafe_local:
+        refused = [r for r in rules if r["checker"]["type"] in ("no_commit", "no_push")]
+        rules = [r for r in rules if r not in refused]
+        for r in refused:
+            err(f"--unsafe-local refuses {r['checker']['type']} probes: skipping {r['id']}")
+    if not rules:
+        err("no active rules with probes; run `obey extract` and `obey probe` first")
+        return 1
+    before = None
+    enforced_files: dict[str, str] | None = None
+    git_hooks: dict[str, str] = {}
+    if args.compare:
+        from obey_cli.enforce import select
+
+        before = json.loads(Path(args.compare).read_text(encoding="utf-8"))
+        broken = select(config, report=before)
+        rules = [r for r in rules if r["id"] in {b["id"] for b in broken}]
+        if not rules:
+            out("Nothing to compare: no rule was broken in the BEFORE report.")
+            return 0
+        enforced_files, git_hooks = _enforcement_files(broken, args.targets.split(","))
+    planned = plan_runs(
+        root,
+        rules,
+        trials=args.trials,
+        baseline_trials=0 if args.no_baseline or args.compare else args.baseline_trials,
+        enforced=enforced_files,
+        enforced_hooks=git_hooks,
+        only_enforced=bool(args.compare),
+    )
+    price = model_price(model) if not args.offline_price else {}
+    est = estimate(planned, agent_name, price)
+    out(f"{est['runs']} runs × ~${est['per_run_usd']:.4f} ≈ ${est['total_usd']:.2f} ({est['source']}; model {model})")
+    if args.estimate:
+        return 0
+    key = _key()
+    if not key:
+        err("set OPENROUTER_API_KEY (or OBEY_API_KEY) to run agents; the key stays outside the sandbox")
+        return 2
+    ledger = Ledger(root / ".obey" / "ledger.jsonl", budget_usd=args.budget)
+    if args.unsafe_local:
+        from obey_cli.runner.local import WARNING, LocalSandbox
+
+        err(WARNING)
+        box: Any = LocalSandbox()
+    else:
+        from obey_cli.runner.sandbox import DockerSandbox, docker_available
+
+        if not docker_available():
+            err("Docker is not available. Start Docker (or colima), or use --unsafe-local (read the README first).")
+            return 2
+        image = args.image or (config.get("sandbox") or {}).get("image") or DEFAULT_IMAGE
+        import subprocess
+
+        from obey_cli.runner.sandbox import docker_cmd
+
+        if subprocess.run([*docker_cmd(), "image", "inspect", image], capture_output=True, check=False).returncode:
+            err(
+                f"sandbox image {image} not found. Build it once with `obey doctor --build-image` (a few GB: Python, "
+                "Node, Go and the agent CLIs from npm), or set sandbox.image in obey.yaml."
+            )
+            return 2
+        box = DockerSandbox(image)
+    allow = list((config.get("sandbox") or {}).get("allow_hosts") or cfg.DEFAULT_ALLOW_HOSTS)
+    remaining = ledger.remaining()
+    batch = box.start_batch(
+        key=key,
+        model=model,
+        price=price,
+        allow_hosts=allow,
+        run_cap=args.run_cap,
+        budget=remaining,
+        run_ids=[p.run_id for p in planned],
+    )
+    stamp = _dt.datetime.now(_dt.timezone.utc).strftime("%Y%m%dT%H%M%SZ")
+    out_dir = Path(args.out) if args.out else root / ".obey" / "runs" / stamp
+    runs_file = out_dir / "runs.jsonl"
+    timeout = int((config.get("sandbox") or {}).get("timeout_s") or 600)
+
+    def run_one(run: Any) -> dict[str, Any]:
+        spec = RunSpec(
+            run_id=run.run_id,
+            prompt=run.probe["instruction"],
+            source=root,
+            probe_id=run.probe["id"],
+            rule_id=run.rule["id"],
+            arm=run.arm,
+            trial=run.trial,
+            overrides=run.overrides,
+            extra_files=run.extra_files,
+            git_hooks=run.git_hooks,
+            setup_patch=run.probe.get("setup_patch"),
+            timeout_s=timeout,
+        )
+        return execute(adapter, spec, box=box, batch=batch, model=model)
+
+    try:
+        result = execute_all(
+            planned,
+            run_one,
+            ledger=ledger,
+            per_run_estimate=est["per_run_usd"],
+            concurrency=args.concurrency,
+            out=runs_file,
+            progress=out,
+        )
+    finally:
+        box.stop_batch(batch)
+    if result.stopped:
+        err(f"stopped early: {result.stopped}")
+    by_id = {r["id"]: r for r in config["rules"]}
+    scores = score_outcomes(outcomes(result.records, by_id))
+    versions = {r.get("agent_version") for r in result.records if r.get("agent_version")}
+    cost = sum(r["usage"]["cost_usd"] for r in result.records)
+    report = build_report(
+        config["rules"],
+        scores,
+        [{"agent": agent_name, "version": next(iter(versions), None), "model": model}],
+        repository=root.name,
+        cost_usd=cost,
+        runs=len(result.records),
+        before=_rule_scores_from_report(before) if before is not None else None,
+    )
+    _write_reports(root, out_dir, report)
+    for line in report["summary"]:
+        out(line + ".")
+    out(f"Report: {out_dir / 'report.html'}  (cost ${cost:.2f} for {len(result.records)} runs)")
+    (root / "obey-badge.json").write_text(json.dumps(badge(report)) + "\n", encoding="utf-8")
+    return 0 if not result.stopped else 3
+
+
+def _write_reports(root: Path, out_dir: Path, report: dict[str, Any]) -> None:
+    import jsonschema
+
+    from obey_cli.report import render_html, render_markdown
+    from obey_cli.resources import schema
+
+    jsonschema.validate(report, schema("report-v1.json"))
+    out_dir.mkdir(parents=True, exist_ok=True)
+    (out_dir / "report.json").write_text(json.dumps(report, indent=2) + "\n", encoding="utf-8")
+    (out_dir / "report.md").write_text(render_markdown(report), encoding="utf-8")
+    (out_dir / "report.html").write_text(render_html(report), encoding="utf-8")
+    latest = root / ".obey"
+    latest.mkdir(exist_ok=True)
+    (latest / "report.json").write_text(json.dumps(report, indent=2) + "\n", encoding="utf-8")
+
+
+# --------------------------------------------------------------------------------------------- report
+
+
+def cmd_report(args: argparse.Namespace) -> int:
+    """Re-score recorded runs with the current checkers and render the report again."""
+    from obey_cli.report import build_report, render_html, render_markdown
+    from obey_cli.runner.orchestrate import outcomes
+    from obey_cli.score import score_outcomes
+
+    root, config = _load(args)
+    runs_path = Path(args.runs)
+    records = [json.loads(line) for line in runs_path.read_text(encoding="utf-8").splitlines() if line.strip()]
+    by_id = {r["id"]: r for r in config["rules"]}
+    scores = score_outcomes(outcomes(records, by_id))
+    agents_seen = sorted({(r["agent"], r.get("agent_version"), r.get("model")) for r in records}, key=lambda x: str(x))
+    report = build_report(
+        config["rules"],
+        scores,
+        [{"agent": a, "version": v, "model": m} for a, v, m in agents_seen],
+        repository=root.name,
+        cost_usd=sum(r["usage"]["cost_usd"] for r in records),
+        runs=len(records),
+    )
+    fmt = args.format
+    if fmt == "json":
+        out(json.dumps(report, indent=2))
+    elif fmt == "md":
+        out(render_markdown(report))
+    elif fmt == "html":
+        out(render_html(report))
+    else:
+        _write_reports(root, runs_path.parent, report)
+        out(f"wrote {runs_path.parent / 'report.html'}, report.md and report.json")
+    return 0
+
+
+# --------------------------------------------------------------------------------------------- enforce
+
+
+def cmd_enforce(args: argparse.Namespace) -> int:
+    from obey_cli.enforce import advisory, plan_enforce, plan_remove, select
+    from obey_cli.enforce.targets import TARGETS
+
+    root = _root(args)
+    if args.remove:
+        plan = plan_remove(root)
+    else:
+        config = cfg.load(root / args.config)
+        report = json.loads(Path(args.from_report).read_text(encoding="utf-8")) if args.from_report else None
+        ids = args.rules.split(",") if args.rules else None
+        rules = select(config, report=report, ids=ids)
+        targets = [t.strip() for t in args.targets.split(",") if t.strip()]
+        unknown = [t for t in targets if t not in TARGETS]
+        if unknown:
+            err(f"unknown target(s): {', '.join(unknown)}; choose from {', '.join(TARGETS)}")
+            return 2
+        if not rules:
+            out(
+                "No rules to enforce (no active rules with a mechanical checker"
+                + (", or none broken in the report)." if report else ").")
+            )
+            return 0
+        plan = plan_enforce(root, rules, targets)
+        for item in advisory(rules, targets):
+            out(f"advisory only: {item['rule_id']} on {item['target']} ({item['reason']})")
+    if args.dry_run:
+        diff = plan.diff()
+        out(diff if diff else "No changes.")
+        return 0
+    written = plan.apply()
+    out("No changes." if not written else "Updated: " + ", ".join(written))
+    if not args.remove and written and "precommit" in args.targets:
+        out(
+            "Git hook: ln -s ../../.obey/pre-commit .git/hooks/pre-commit && "
+            "ln -s ../../.obey/pre-commit .git/hooks/commit-msg  (or use the pre-commit framework; see the README)"
+        )
+    return 0
+
+
+def cmd_precommit(args: argparse.Namespace) -> int:
+    """Entry point for the pre-commit framework: runs .obey/pre-commit (generated by `obey enforce`)."""
+    import runpy
+
+    root = _root(args)
+    script = root / ".obey" / "pre-commit"
+    if not script.exists():
+        err("no .obey/pre-commit here; run `obey enforce --targets precommit` first")
+        return 1
+    argv = [str(script), *args.files[-1:]] if args.commit_msg and args.files else [str(script)]
+    sys.argv = argv
+    try:
+        runpy.run_path(str(script), run_name="__main__")
+    except SystemExit as exc:
+        return int(exc.code or 0)
+    return 0
+
+
+# --------------------------------------------------------------------------------------------- lint
+
+
+def cmd_lint(args: argparse.Namespace) -> int:
+    from obey_cli.lint import lint
+
+    root = _root(args)
+    result = lint(root, args.config, write_badge=not args.no_badge)
+    for line in result.lines:
+        out(line)
+    return 0 if result.ok else 1
+
+
+# --------------------------------------------------------------------------------------------- doctor
+
+
+def cmd_doctor(args: argparse.Namespace) -> int:
+    import platform
+    import shutil
+    import subprocess
+
+    from obey_cli import __version__
+    from obey_cli.runner.sandbox import docker_available, docker_cmd
+
+    rows = [("obey", __version__), ("python", platform.python_version())]
+    rows.append(("git", "yes" if shutil.which("git") else "missing (required)"))
+    docker = docker_available()
+    rows.append(
+        (
+            "docker",
+            "available"
+            if docker
+            else f"not available ({' '.join(docker_cmd())}); use colima or Docker Desktop, or --unsafe-local",
+        )
+    )
+    image = args.image or DEFAULT_IMAGE
+    if docker:
+        probe = subprocess.run([*docker_cmd(), "image", "inspect", image], capture_output=True, check=False)
+        rows.append(
+            ("sandbox image", image if probe.returncode == 0 else f"{image} missing (obey doctor --build-image)")
+        )
+        if args.build_image:
+            from obey_cli.resources import data_path
+
+            context = Path(__file__).parent / "runner" / "sandbox"
+            out(f"building {image} from {context} (a few GB) ...")
+            code = subprocess.run([*docker_cmd(), "build", "-t", image, str(context)], check=False).returncode
+            rows.append(("build", "ok" if code == 0 else f"failed ({code})"))
+            _ = data_path
+        elif probe.returncode == 0:
+            versions = subprocess.run(
+                [
+                    *docker_cmd(),
+                    "run",
+                    "--rm",
+                    "--entrypoint",
+                    "sh",
+                    image,
+                    "-c",
+                    "claude --version; codex --version; opencode --version; copilot --version; gemini --version",
+                ],
+                capture_output=True,
+                text=True,
+                check=False,
+                timeout=120,
+            ).stdout
+            for line in versions.strip().splitlines():
+                rows.append(("  agent", line.strip()))
+    key = _key()
+    rows.append(
+        ("API key", "set (kept outside the sandbox)" if key else "not set (OPENROUTER_API_KEY or OBEY_API_KEY)")
+    )
+    root = _root(args)
+    rows.append(("obey.yaml", "found" if (root / args.config).exists() else "missing (obey extract)"))
+    width = max(len(k) for k, _ in rows)
+    for k, v in rows:
+        out(f"{k.ljust(width)}  {v}")
+    return 0
+
+
+# --------------------------------------------------------------------------------------------- init
+
+
+def cmd_init(args: argparse.Namespace) -> int:
+    """extract + probe, then print what to do next."""
+    code = cmd_extract_from_commands(args)
+    if code != 0:
+        return code
+    cmd_probe(argparse.Namespace(**{**vars(args), "regenerate": False}))
+    out("")
+    out("Next: review obey.yaml, then")
+    out("  obey run --estimate --model anthropic/claude-haiku-5.5   # how many runs, roughly what it costs")
+    out("  obey run --model anthropic/claude-haiku-5.5              # needs Docker and OPENROUTER_API_KEY")
+    out("  obey enforce --from .obey/report.json                     # hooks for the rules your agent broke")
+    out("  obey lint                                                 # in CI, no agent runs")
+    return 0
+
+
+def cmd_extract_from_commands(args: argparse.Namespace) -> int:
+    from obey_cli.cli import cmd_extract
+
+    defaults = {"llm": False, "llm_model": None, "budget": 1.0, "include_local": False, "dry_run": False}
+    return cmd_extract(argparse.Namespace(**{**defaults, **vars(args)}))
+
+
+# --------------------------------------------------------------------------------------------- study
+
+
+def cmd_study(args: argparse.Namespace) -> int:
+    root = _root(args)
+    action = args.study_command
+    if action == "survey":
+        return _study_survey(args, root)
+    if action == "run":
+        return _study_run(args, root)
+    if action == "plan":
+        return _study_plan(args, root)
+    if action == "report":
+        from obey_cli.study.report import write_report
+
+        out(write_report(root))
+        return 0
+    err("choose one of: survey, run, plan, report")
+    return 2
+
+
+def _study_survey(args: argparse.Namespace, root: Path) -> int:
+    from obey_cli.study import survey
+
+    folder = root / "study" / "survey"
+    sample = folder / "sample.jsonl"
+    if args.collect:
+        token = os.environ.get("GITHUB_TOKEN", "")
+        if not token:
+            err("set GITHUB_TOKEN for GitHub code search")
+            return 2
+        survey.collect(token, sample, target=args.target, log=out)
+    if args.analyse:
+        survey.analyse(sample, folder / "features.jsonl", log=out)
+    if args.llm:
+        from obey_cli.llm import LLMConfig
+        from obey_cli.runner.ledger import Ledger
+
+        ledger = Ledger(root / ".obey" / "survey-ledger.jsonl", budget_usd=args.budget)
+        survey.llm_pass(sample, folder / "llm.jsonl", LLMConfig.from_env(args.llm_model), ledger, log=out)
+    summary = survey.summarise(folder / "features.jsonl", folder / "llm.jsonl", sample)
+    (folder / "summary.json").write_text(json.dumps(summary, indent=2) + "\n", encoding="utf-8")
+    out(json.dumps({k: v for k, v in summary.items() if k not in ("types", "licences")}, indent=2))
+    return 0
+
+
+def _study_run(args: argparse.Namespace, root: Path) -> int:
+    from obey_cli.study import design as d
+    from obey_cli.study import experiment
+
+    design = d.load(root / "study" / "design.yaml")
+    key = _key()
+    filters = {
+        k: v.split(",") for k, v in (("repos", args.repos), ("slots", args.slots), ("harnesses", args.harnesses)) if v
+    }
+    phase = args.phase
+    if args.phase == "enforce":
+        # Cells whose `--from-condition` runs were violated at least once in the main grid are re-run in that same
+        # condition with hooks. The pre-registered phase uses the imperative condition; `baseline` measures hooks
+        # without the rule in AGENTS.md (the hook's refusal still quotes the rule).
+        cond = args.from_condition
+        phase = "enforce" if cond == "imperative" else f"enforce-{cond}"
+        verdicts = Path(args.verdicts) if args.verdicts else root / "study" / "results" / "main.jsonl"
+        rows = [json.loads(line) for line in verdicts.read_text().splitlines() if line.strip()]
+        broken = sorted(
+            {
+                (r["repo"], r["slot"], r["harness"])
+                for r in rows
+                if r["status"] == "ok" and r["condition"] == cond and r["verdict"] == "violated"
+            }
+        )
+        out(f"{phase}: {len(broken)} slot × repository × harness cells were violated in the {cond} condition")
+        runs = [
+            experiment.StudyRun(phase, d.Cell(repo, slot, cond, harness), t)
+            for repo, slot, harness in broken
+            for t in range(args.trials)
+        ]
+    else:
+        runs = experiment.plan(design, args.phase, args.trials, **filters)
+    if args.estimate:
+        out(f"{len(runs)} runs planned for phase {phase}")
+        return 0
+    if not key:
+        err("set OPENROUTER_API_KEY")
+        return 2
+    result = experiment.execute(
+        design,
+        runs,
+        root=root,
+        key=key,
+        image=args.image or DEFAULT_IMAGE,
+        budget=args.budget,
+        spent_before=0.0,
+        concurrency=args.concurrency,
+        results=root / "study" / "results",
+        enforce_rules=args.phase == "enforce",
+        progress=out,
+    )
+    out(json.dumps(result))
+    return 0 if not result["stopped"] else 3
+
+
+def _study_plan(args: argparse.Namespace, root: Path) -> int:
+    from obey_cli.study.analysis import trials_needed
+
+    rows = [
+        json.loads(line)
+        for line in (root / "study" / "results" / "pilot.jsonl").read_text().splitlines()
+        if line.strip()
+    ]
+    plan = trials_needed(rows)
+    ok = [r for r in rows if r["status"] == "ok"]
+    plan["pilot_runs"] = len(rows)
+    plan["pilot_cost_usd"] = sum(r["cost_usd"] for r in rows)
+    plan["cost_per_run_usd"] = plan["pilot_cost_usd"] / len(ok) if ok else None
+    plan["main_runs"] = plan["trials_per_cell"] * 160
+    plan["main_cost_usd"] = plan["main_runs"] * (plan["cost_per_run_usd"] or 0)
+    (root / "study" / "results" / "plan.json").write_text(json.dumps(plan, indent=2) + "\n", encoding="utf-8")
+    out(json.dumps(plan, indent=2))
+    return 0
+
+
+# --------------------------------------------------------------------------------------------- demo
+
+
+def _read_runs(path: Path) -> list[dict[str, Any]]:
+    import gzip
+
+    if not path.exists():
+        return []
+    with gzip.open(path, "rt", encoding="utf-8") as fh:
+        return [json.loads(line) for line in fh if line.strip()]
+
+
+def _cut(text: str, width: int) -> str:
+    text = " ".join(str(text).split())
+    return text if len(text) <= width else text[: width - 1] + "…"
+
+
+def cmd_demo(args: argparse.Namespace) -> int:
+    """Replay recorded study runs on the bundled demo repository: no API key, no Docker."""
+    from obey_cli.report import build_report, render_html
+    from obey_cli.resources import data_path
+    from obey_cli.runner.orchestrate import outcomes
+    from obey_cli.score import AGENT_NAMES, score_outcomes
+
+    demo = data_path("demo")
+    config = cfg.load(demo / "obey.yaml")
+    rules = {r["id"]: r for r in config["rules"]}
+    before_runs = _read_runs(demo / "runs" / "before.jsonl.gz")
+    after_runs = _read_runs(demo / "runs" / "after.jsonl.gz")
+    before = score_outcomes(outcomes(before_runs, rules))
+    after = score_outcomes(outcomes(after_runs, rules))
+    meta = json.loads((demo / "runs" / "meta.json").read_text(encoding="utf-8"))
+    report = build_report(
+        config["rules"],
+        before + after,
+        [{"agent": meta["agent"], "version": meta["agent_version"], "model": meta["model"]}],
+        repository=meta["repository"],
+        cost_usd=meta["cost_usd"],
+        runs=meta["runs"],
+        before=before,
+        before_arm=meta.get("compare_with", "rule"),
+    )
+    name = AGENT_NAMES.get(meta["agent"], meta["agent"])
+    out(
+        f"obey demo: {len(before_runs) + len(after_runs)} recorded runs of {name} {meta['agent_version']} with "
+        f"{meta['model']} on {meta['repository']} ({meta['dates']}), replayed and re-scored now."
+    )
+    out("Probe compliance: obeyed ÷ exercised runs on tempting tasks, Wilson 95% interval.")
+    out("")
+    out(f"{'Rule (AGENTS.md)':58s} {'Compliance':>17s} {'No rule':>9s} {'Exercised':>9s}")
+    base = {s.rule_id: s for s in before if s.arm == "baseline"}
+    for s in sorted((s for s in before if s.arm == "rule"), key=lambda s: (s.compliance is None, s.compliance or 0)):
+        rule = rules[s.rule_id]
+        comp = (
+            "never exercised"
+            if s.compliance is None
+            else (f"{s.compliance * 100:3.0f}% [{(s.ci_low or 0) * 100:2.0f}–{(s.ci_high or 0) * 100:3.0f}]")
+        )
+        b = base.get(s.rule_id)
+        baseline = f"{b.compliance * 100:.0f}%" if b and b.compliance is not None else "–"
+        out(f"{_cut(rule['text'], 58):58s} {comp:>17s} {baseline:>9s} {s.exercised:>4d}/{s.runs:<4d}")
+    out("")
+    for line in report["summary"]:
+        out(line + ".")
+    cmp = report.get("compare") or {}
+    rows = [r for r in cmp.get("rows", []) if r["after"] is not None]
+    if rows:
+        out("")
+        if meta.get("compare_with") == "baseline":
+            out("With hooks from `obey enforce` and the rule left out of AGENTS.md (same probes, same agent):")
+            out(f"{'Rule':58s} {'No rule':>7s} {'+hooks':>7s} {'Blocked':>8s} {'Evasions':>9s}")
+        else:
+            out("With hooks from `obey enforce` (same probes, same agent):")
+            out(f"{'Rule':58s} {'Before':>7s} {'After':>7s} {'Blocked':>8s} {'Evasions':>9s}")
+        for r in rows:
+            before_pct = r["before"] * 100 if r["before"] is not None else 0.0
+            text = _cut(rules[r["rule_id"]]["text"], 58)
+            out(f"{text:58s} {before_pct:6.0f}% {r['after'] * 100:6.0f}% {r['blocked_runs']:8d} {r['evasions']:9d}")
+        a, b = cmp["after"], cmp["before"]
+        out(
+            f"Pooled: {(b['compliance'] or 0) * 100:.0f}% → {(a['compliance'] or 0) * 100:.0f}%; "
+            f"{a['evasions']} of {a['blocked_runs']} blocked runs still broke the rule another way."
+        )
+    if args.html:
+        Path(args.html).write_text(render_html(report), encoding="utf-8")
+        out(f"HTML report: {args.html}")
+    out("")
+    out("Your own rules: cd your-repo && obey init && obey run --estimate --model anthropic/claude-haiku-5.5")
+    return 0