cool-workflow 0.2.2 → 0.2.3

package/dist/shell/multi-agent-cli.js

@@ -113,6 +113,7 @@ exports.evalScoreCli = evalScoreCli;
 exports.evalGateCli = evalGateCli;
 exports.evalReportCli = evalReportCli;
 const path = __importStar(require("node:path"));
+const numeric_flag_1 = require("../core/util/numeric-flag");
 const run_store_1 = require("./run-store");
 const report_1 = require("./report");
 const mai = __importStar(require("./multi-agent-io"));
@@ -140,6 +141,18 @@ function invocationCwd(args) {
 function loadRun(args, runId) {
     return (0, run_store_1.loadRunFromCwd)(runId, invocationCwd(args));
 }
+/** Hold the run's state.json lock across the WHOLE load -> change ->
+ *  persist cycle. A bare loadRun + persist pair races: two processes both
+ *  load the same state and the later persist silently drops the earlier
+ *  change (reproduced — N concurrent `blackboard topic create` on one run
+ *  kept only 1). withRunStateLock loads the run UNDER the lock, and the
+ *  saveCheckpoint inside persist re-enters that same lock (withFileLock is
+ *  in-process re-entrant), exactly as pipeline-cli.ts's dispatchRun /
+ *  recordResultRun already do. Every persist()-calling verb in this file
+ *  runs through here; read-only verbs keep the lock-free loadRun. */
+function mutateRun(args, runId, fn) {
+    return (0, run_store_1.withRunStateLock)(runId, invocationCwd(args), fn);
+}
 function persist(run) {
     (0, run_store_1.saveCheckpoint)(run);
     (0, report_1.writeReport)(run);
@@ -294,27 +307,28 @@ function topologyValidateCli(topologyId) {
 function topologyApplyCli(args) {
     const runId = requireArg(args.runId, "run id");
     const topologyId = requireArg(args.topologyId ?? args.id, "topology id");
-    const run = loadRun(args, runId);
-    const record = topio.applyTopology(run, topologyId, {
-        // #30: `topology apply <run> <topology> --id <custom>` — the custom
-        // topology-run id arrives as `--id` (parseArgv key `id`), NOT `id2`
-        // (which no CLI/MCP surface ever emits). On CLI the topology id comes
-        // from positional[1] (capability-table), so `args.id` is free for the
-        // run-id override; on MCP the handler pre-maps topologyId from
-        // `topologyId ?? id`. Byte-exact to the old build's
-        // `id: stringOption(options.id)` (orchestrator/topology-operations.ts).
-        id: optionalString(args.id),
-        task: undefined,
-        taskIds: arrayArg(args.task ?? args.taskId),
-        mapperCount: numberArg(args.mapperCount ?? args["mapper-count"] ?? args.mappers ?? args.mapper),
-        judgeCount: numberArg(args.judgeCount ?? args["judge-count"] ?? args.judges ?? args.judge),
-        debateRounds: numberArg(args.debateRounds ?? args["debate-rounds"] ?? args.rounds),
-        blackboardId: blackboardIdArg(args),
-        multiAgentRunId: multiAgentRunArg(args),
-        collectInitialFanin: boolArg(args.collectInitialFanin ?? args["collect-initial-fanin"]),
+    return mutateRun(args, runId, (run) => {
+        const record = topio.applyTopology(run, topologyId, {
+            // #30: `topology apply <run> <topology> --id <custom>` — the custom
+            // topology-run id arrives as `--id` (parseArgv key `id`), NOT `id2`
+            // (which no CLI/MCP surface ever emits). On CLI the topology id comes
+            // from positional[1] (capability-table), so `args.id` is free for the
+            // run-id override; on MCP the handler pre-maps topologyId from
+            // `topologyId ?? id`. Byte-exact to the old build's
+            // `id: stringOption(options.id)` (orchestrator/topology-operations.ts).
+            id: optionalString(args.id),
+            task: undefined,
+            taskIds: arrayArg(args.task ?? args.taskId),
+            mapperCount: numberArg(args.mapperCount ?? args["mapper-count"] ?? args.mappers ?? args.mapper),
+            judgeCount: numberArg(args.judgeCount ?? args["judge-count"] ?? args.judges ?? args.judge),
+            debateRounds: numberArg(args.debateRounds ?? args["debate-rounds"] ?? args.rounds),
+            blackboardId: blackboardIdArg(args),
+            multiAgentRunId: multiAgentRunArg(args),
+            collectInitialFanin: boolArg(args.collectInitialFanin ?? args["collect-initial-fanin"]),
+        });
+        persist(run);
+        return record;
     });
-    persist(run);
-    return record;
 }
 function topologySummaryCli(args) {
     const runId = requireArg(args.runId, "run id");
@@ -338,59 +352,60 @@ function topologyRunShowCli(args, topologyRunId) {
 // ---------------------------------------------------------------------------
 function multiAgentRunCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const topology = optionalString(args.topology);
-    // `multi-agent run <run> <id> --status <status>` — port of the old CLI
-    // handler's `id && args.options.status` arm (cli/handlers/multi-agent.ts):
-    // transition the MultiAgentRun lifecycle (the core cascades completion to
-    // owned roles/groups/fanouts/fanins, or fails closed when a fanin is not
-    // verifier-ready). `multiAgentRunId` is the positional entity id the CLI
-    // binding forwards (or the `--id`/`--multi-agent-run` alias the MCP peer
-    // sends).
-    const transitionId = optionalString(args.multiAgentRunId ?? args.id ?? args.multiAgentRun);
-    const status = optionalString(args.status);
-    const app = optionalString(args.app ?? args.appId);
-    const workflow = optionalString(args.workflow ?? args.workflowId);
-    const isHostRun = !runId || topology !== undefined || app !== undefined || workflow !== undefined;
-    if (!isHostRun && transitionId && status && args.title === undefined && args.objective === undefined) {
-        const record = mai.transitionMultiAgentRun(run, transitionId, status, {
-            reason: optionalString(args.reason),
-            actor: optionalString(args.actor),
-        });
+    return mutateRun(args, runId, (run) => {
+        const topology = optionalString(args.topology);
+        // `multi-agent run <run> <id> --status <status>` — port of the old CLI
+        // handler's `id && args.options.status` arm (cli/handlers/multi-agent.ts):
+        // transition the MultiAgentRun lifecycle (the core cascades completion to
+        // owned roles/groups/fanouts/fanins, or fails closed when a fanin is not
+        // verifier-ready). `multiAgentRunId` is the positional entity id the CLI
+        // binding forwards (or the `--id`/`--multi-agent-run` alias the MCP peer
+        // sends).
+        const transitionId = optionalString(args.multiAgentRunId ?? args.id ?? args.multiAgentRun);
+        const status = optionalString(args.status);
+        const app = optionalString(args.app ?? args.appId);
+        const workflow = optionalString(args.workflow ?? args.workflowId);
+        const isHostRun = !runId || topology !== undefined || app !== undefined || workflow !== undefined;
+        if (!isHostRun && transitionId && status && args.title === undefined && args.objective === undefined) {
+            const record = mai.transitionMultiAgentRun(run, transitionId, status, {
+                reason: optionalString(args.reason),
+                actor: optionalString(args.actor),
+            });
+            persist(run);
+            return record;
+        }
+        if (!isHostRun && transitionId && !status && args.title === undefined && args.objective === undefined && args.id === undefined) {
+            // `multi-agent run <run> <id>` (positional id, no status/create flags) —
+            // SHOW the MultiAgentRun record (old handler's showMultiAgentRun arm).
+            const record = (0, runtime_1.getMultiAgentRun)(run, transitionId);
+            if (!record)
+                throw new Error(`Unknown MultiAgentRun id: ${transitionId}`);
+            return record;
+        }
+        let result;
+        if (topology === undefined && (args.id !== undefined || args.title !== undefined)) {
+            // #28: forward `--blackboard`/`--topic` (plus the old build's
+            // objective/parent/phase reads) into the kernel input so a plain
+            // `multi-agent run <run> --id ma --blackboard bb --topic t` carries the
+            // blackboard linkage. Byte-exact to the old build's createMultiAgentRun
+            // option map (orchestrator/multi-agent-operations.ts).
+            result = mai.createMultiAgentRun(run, {
+                id: optionalString(args.id),
+                title: optionalString(args.title),
+                objective: optionalString(args.objective ?? args.reason),
+                parentMultiAgentRunId: optionalString(args.parent ?? args.parentMultiAgentRunId),
+                phase: optionalString(args.phase),
+                phaseId: optionalString(args.phaseId),
+                blackboardId: blackboardIdArg(args),
+                topicIds: topicIdsArg(args),
+            });
+        }
+        else {
+            result = host.hostRun(run, args);
+        }
         persist(run);
-        return record;
-    }
-    if (!isHostRun && transitionId && !status && args.title === undefined && args.objective === undefined && args.id === undefined) {
-        // `multi-agent run <run> <id>` (positional id, no status/create flags) —
-        // SHOW the MultiAgentRun record (old handler's showMultiAgentRun arm).
-        const record = (0, runtime_1.getMultiAgentRun)(run, transitionId);
-        if (!record)
-            throw new Error(`Unknown MultiAgentRun id: ${transitionId}`);
-        return record;
-    }
-    let result;
-    if (topology === undefined && (args.id !== undefined || args.title !== undefined)) {
-        // #28: forward `--blackboard`/`--topic` (plus the old build's
-        // objective/parent/phase reads) into the kernel input so a plain
-        // `multi-agent run <run> --id ma --blackboard bb --topic t` carries the
-        // blackboard linkage. Byte-exact to the old build's createMultiAgentRun
-        // option map (orchestrator/multi-agent-operations.ts).
-        result = mai.createMultiAgentRun(run, {
-            id: optionalString(args.id),
-            title: optionalString(args.title),
-            objective: optionalString(args.objective ?? args.reason),
-            parentMultiAgentRunId: optionalString(args.parent ?? args.parentMultiAgentRunId),
-            phase: optionalString(args.phase),
-            phaseId: optionalString(args.phaseId),
-            blackboardId: blackboardIdArg(args),
-            topicIds: topicIdsArg(args),
-        });
-    }
-    else {
-        result = host.hostRun(run, args);
-    }
-    persist(run);
-    return result;
+        return result;
+    });
 }
 function multiAgentStatusCli(args) {
     const runId = requireArg(args.runId, "run id");
@@ -447,14 +462,15 @@ function multiAgentEvidenceCli(args) {
  *  the old runner.multiAgentReasoning / multiAgentReasoningRefresh. */
 function multiAgentReasoningCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
     const evidenceId = optionalString(args.evidence ?? args.evidenceId ?? args.id);
     if (args.refresh && !evidenceId) {
-        const index = reasoning.refreshEvidenceReasoning(run);
-        persist(run);
-        return index;
+        return mutateRun(args, runId, (run) => {
+            const index = reasoning.refreshEvidenceReasoning(run);
+            persist(run);
+            return index;
+        });
     }
-    return reasoning.showEvidenceReasoning(run, { evidenceId });
+    return reasoning.showEvidenceReasoning(loadRun(args, runId), { evidenceId });
 }
 function multiAgentReasoningText(args) {
     const runId = requireArg(args.runId, "run id");
@@ -464,10 +480,11 @@ function multiAgentReasoningText(args) {
 }
 function multiAgentReasoningRefreshCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const index = reasoning.refreshEvidenceReasoning(run);
-    persist(run);
-    return index;
+    return mutateRun(args, runId, (run) => {
+        const index = reasoning.refreshEvidenceReasoning(run);
+        persist(run);
+        return index;
+    });
 }
 function multiAgentEvidenceText(args) {
     const runId = requireArg(args.runId, "run id");
@@ -481,182 +498,197 @@ function multiAgentEvidenceText(args) {
 }
 function multiAgentStepCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const result = host.hostStep(run, args);
-    persist(run);
-    return result;
+    return mutateRun(args, runId, (run) => {
+        const result = host.hostStep(run, args);
+        persist(run);
+        return result;
+    });
 }
 function multiAgentBlackboardCli(args, action) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const result = host.hostBlackboard(run, action, args);
-    persist(run);
-    return result;
+    return mutateRun(args, runId, (run) => {
+        const result = host.hostBlackboard(run, action, args);
+        persist(run);
+        return result;
+    });
 }
 function multiAgentScoreCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const result = host.hostScore(run, args);
-    persist(run);
-    return result;
+    return mutateRun(args, runId, (run) => {
+        const result = host.hostScore(run, args);
+        persist(run);
+        return result;
+    });
 }
 function multiAgentSelectCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const result = host.hostSelect(run, args);
-    persist(run);
-    return result;
+    return mutateRun(args, runId, (run) => {
+        const result = host.hostSelect(run, args);
+        persist(run);
+        return result;
+    });
 }
 function multiAgentRoleCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const roleId = optionalString(args.roleId);
-    const multiAgentRunId = multiAgentRunArg(args);
-    if (roleId && !args.id && !multiAgentRunId) {
-        const role = (0, runtime_1.getAgentRole)(run, roleId);
-        if (!role)
-            throw new Error(`Unknown AgentRole id: ${roleId}`);
+    return mutateRun(args, runId, (run) => {
+        const roleId = optionalString(args.roleId);
+        const multiAgentRunId = multiAgentRunArg(args);
+        if (roleId && !args.id && !multiAgentRunId) {
+            const role = (0, runtime_1.getAgentRole)(run, roleId);
+            if (!role)
+                throw new Error(`Unknown AgentRole id: ${roleId}`);
+            return role;
+        }
+        // #29: parseArgv keeps `--required-evidence` etc. as their literal kebab
+        // keys, so the old camelCase-only reads folded to []. Read BOTH the kebab
+        // CLI key and the camelCase MCP alias, byte-exact to the old build's
+        // createAgentRole option map (orchestrator/multi-agent-operations.ts).
+        const role = mai.createAgentRole(run, {
+            id: optionalString(args.id) ?? roleId,
+            multiAgentRunId: requireArg(multiAgentRunId, "multi-agent run id"),
+            title: optionalString(args.title),
+            responsibilities: arrayArg(args.responsibility ?? args.responsibilities),
+            requiredEvidence: arrayArg(args.requiredEvidence ?? args["required-evidence"]),
+            sandboxProfileHints: arrayArg(args.sandbox ?? args.sandboxProfile ?? args.sandboxProfileHint ?? args["sandbox-profile"]),
+            expectedArtifacts: arrayArg(args.expectedArtifact ?? args.expectedArtifacts ?? args["expected-artifact"]),
+            faninObligations: arrayArg(args.faninObligation ?? args.faninObligations ?? args["fanin-obligation"]),
+            parentRoleId: optionalString(args.parent ?? args.parentRoleId),
+            blackboardId: blackboardIdArg(args),
+            topicIds: topicIdsArg(args),
+        });
+        persist(run);
         return role;
-    }
-    // #29: parseArgv keeps `--required-evidence` etc. as their literal kebab
-    // keys, so the old camelCase-only reads folded to []. Read BOTH the kebab
-    // CLI key and the camelCase MCP alias, byte-exact to the old build's
-    // createAgentRole option map (orchestrator/multi-agent-operations.ts).
-    const role = mai.createAgentRole(run, {
-        id: optionalString(args.id) ?? roleId,
-        multiAgentRunId: requireArg(multiAgentRunId, "multi-agent run id"),
-        title: optionalString(args.title),
-        responsibilities: arrayArg(args.responsibility ?? args.responsibilities),
-        requiredEvidence: arrayArg(args.requiredEvidence ?? args["required-evidence"]),
-        sandboxProfileHints: arrayArg(args.sandbox ?? args.sandboxProfile ?? args.sandboxProfileHint ?? args["sandbox-profile"]),
-        expectedArtifacts: arrayArg(args.expectedArtifact ?? args.expectedArtifacts ?? args["expected-artifact"]),
-        faninObligations: arrayArg(args.faninObligation ?? args.faninObligations ?? args["fanin-obligation"]),
-        parentRoleId: optionalString(args.parent ?? args.parentRoleId),
-        blackboardId: blackboardIdArg(args),
-        topicIds: topicIdsArg(args),
     });
-    persist(run);
-    return role;
 }
 function multiAgentGroupCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const groupId = optionalString(args.groupId);
-    const multiAgentRunId = multiAgentRunArg(args);
-    if (groupId && !args.id && !multiAgentRunId) {
-        const group = (0, runtime_1.getAgentGroup)(run, groupId);
-        if (!group)
-            throw new Error(`Unknown AgentGroup id: ${groupId}`);
+    return mutateRun(args, runId, (run) => {
+        const groupId = optionalString(args.groupId);
+        const multiAgentRunId = multiAgentRunArg(args);
+        if (groupId && !args.id && !multiAgentRunId) {
+            const group = (0, runtime_1.getAgentGroup)(run, groupId);
+            if (!group)
+                throw new Error(`Unknown AgentGroup id: ${groupId}`);
+            return group;
+        }
+        // #28: forward `--blackboard`/`--topic` (plus phaseId/parent) into the
+        // kernel input. Byte-exact to the old createAgentGroup option map.
+        const group = mai.createAgentGroup(run, {
+            id: optionalString(args.id) ?? groupId,
+            multiAgentRunId: requireArg(multiAgentRunId, "multi-agent run id"),
+            title: optionalString(args.title),
+            phase: optionalString(args.phase),
+            phaseId: optionalString(args.phaseId),
+            taskIds: arrayArg(args.task ?? args.taskId ?? args.tasks),
+            parentGroupId: optionalString(args.parent ?? args.parentGroupId),
+            blackboardId: blackboardIdArg(args),
+            topicIds: topicIdsArg(args),
+        });
+        persist(run);
         return group;
-    }
-    // #28: forward `--blackboard`/`--topic` (plus phaseId/parent) into the
-    // kernel input. Byte-exact to the old createAgentGroup option map.
-    const group = mai.createAgentGroup(run, {
-        id: optionalString(args.id) ?? groupId,
-        multiAgentRunId: requireArg(multiAgentRunId, "multi-agent run id"),
-        title: optionalString(args.title),
-        phase: optionalString(args.phase),
-        phaseId: optionalString(args.phaseId),
-        taskIds: arrayArg(args.task ?? args.taskId ?? args.tasks),
-        parentGroupId: optionalString(args.parent ?? args.parentGroupId),
-        blackboardId: blackboardIdArg(args),
-        topicIds: topicIdsArg(args),
     });
-    persist(run);
-    return group;
 }
 function multiAgentMembershipCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const membershipId = optionalString(args.membershipId);
-    const groupId = groupArg(args);
-    const roleId = optionalString(args.roleId ?? args.role);
-    if (membershipId && !args.id && !groupId && !roleId) {
-        const membership = (0, runtime_1.getAgentMembership)(run, membershipId);
-        if (!membership)
-            throw new Error(`Unknown AgentMembership id: ${membershipId}`);
+    return mutateRun(args, runId, (run) => {
+        const membershipId = optionalString(args.membershipId);
+        const groupId = groupArg(args);
+        const roleId = optionalString(args.roleId ?? args.role);
+        if (membershipId && !args.id && !groupId && !roleId) {
+            const membership = (0, runtime_1.getAgentMembership)(run, membershipId);
+            if (!membership)
+                throw new Error(`Unknown AgentMembership id: ${membershipId}`);
+            return membership;
+        }
+        // #28: forward `--blackboard`/`--topic` (plus multiAgentRunId/status) into
+        // the kernel input. Byte-exact to the old assignAgentMembership option map.
+        const membership = mai.assignAgentMembership(run, {
+            id: optionalString(args.id) ?? membershipId,
+            multiAgentRunId: multiAgentRunArg(args),
+            groupId: requireArg(groupId, "group id"),
+            roleId: requireArg(roleId, "role id"),
+            taskId: requireArg(args.taskId ?? args.task, "task id"),
+            workerId: optionalString(args.workerId ?? args.worker),
+            dispatchId: optionalString(args.dispatchId ?? args.dispatch),
+            fanoutId: optionalString(args.fanoutId ?? args.fanout ?? args["multi-agent-fanout"]),
+            status: optionalString(args.status),
+            blackboardId: blackboardIdArg(args),
+            topicIds: topicIdsArg(args),
+        });
+        persist(run);
         return membership;
-    }
-    // #28: forward `--blackboard`/`--topic` (plus multiAgentRunId/status) into
-    // the kernel input. Byte-exact to the old assignAgentMembership option map.
-    const membership = mai.assignAgentMembership(run, {
-        id: optionalString(args.id) ?? membershipId,
-        multiAgentRunId: multiAgentRunArg(args),
-        groupId: requireArg(groupId, "group id"),
-        roleId: requireArg(roleId, "role id"),
-        taskId: requireArg(args.taskId ?? args.task, "task id"),
-        workerId: optionalString(args.workerId ?? args.worker),
-        dispatchId: optionalString(args.dispatchId ?? args.dispatch),
-        fanoutId: optionalString(args.fanoutId ?? args.fanout ?? args["multi-agent-fanout"]),
-        status: optionalString(args.status),
-        blackboardId: blackboardIdArg(args),
-        topicIds: topicIdsArg(args),
     });
-    persist(run);
-    return membership;
 }
 function multiAgentFanoutCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const fanoutId = optionalString(args.fanoutId);
-    const groupId = groupArg(args);
-    if (fanoutId && !args.id && !groupId) {
-        const fanout = (0, runtime_1.getAgentFanout)(run, fanoutId);
-        if (!fanout)
-            throw new Error(`Unknown AgentFanout id: ${fanoutId}`);
+    return mutateRun(args, runId, (run) => {
+        const fanoutId = optionalString(args.fanoutId);
+        const groupId = groupArg(args);
+        if (fanoutId && !args.id && !groupId) {
+            const fanout = (0, runtime_1.getAgentFanout)(run, fanoutId);
+            if (!fanout)
+                throw new Error(`Unknown AgentFanout id: ${fanoutId}`);
+            return fanout;
+        }
+        // #28: forward `--blackboard`/`--topic` so `fanout.blackboardId` inherits
+        // the board (kernel: input.blackboardId || group.blackboardId ||
+        // multiAgentRun.blackboardId). Also port the old build's fuller fanout
+        // reads (multiAgentRunId, workerIds/membershipIds/dispatchIds,
+        // sandboxProfileChoices, expectedReturnShape).
+        const fanout = mai.createAgentFanout(run, {
+            id: optionalString(args.id) ?? fanoutId,
+            multiAgentRunId: multiAgentRunArg(args),
+            groupId: requireArg(groupId, "group id"),
+            reason: requireArg(args.reason, "reason"),
+            roleIds: arrayArg(args.role ?? args.roleId ?? args.roles),
+            taskIds: arrayArg(args.task ?? args.taskId ?? args.tasks),
+            workerIds: arrayArg(args.worker ?? args.workerId ?? args.workers),
+            membershipIds: arrayArg(args.membership ?? args.membershipId ?? args.memberships),
+            dispatchIds: arrayArg(args.dispatch ?? args.dispatchId ?? args.dispatches),
+            // This one flag (aliased --limit/--concurrency/--concurrencyLimit) goes
+            // through requiredNumberFlag, not the file's own lenient numberArg — a
+            // bare flag here used to silently mean "no limit" (fan out unbounded),
+            // the opposite of the "silently means 1" bug the same audit found in
+            // metrics-cli.ts/registry-cli.ts's own --limit handling; both now fail
+            // loud instead of guessing in either direction.
+            concurrencyLimit: (0, numeric_flag_1.requiredNumberFlag)(args.limit ?? args.concurrency ?? args.concurrencyLimit, "--limit"),
+            sandboxProfileChoices: parseSandboxChoicesCli(args),
+            expectedReturnShape: optionalString(args.expectedReturnShape ?? args["expected-return-shape"]),
+            blackboardId: blackboardIdArg(args),
+            topicIds: topicIdsArg(args),
+        });
+        persist(run);
         return fanout;
-    }
-    // #28: forward `--blackboard`/`--topic` so `fanout.blackboardId` inherits
-    // the board (kernel: input.blackboardId || group.blackboardId ||
-    // multiAgentRun.blackboardId). Also port the old build's fuller fanout
-    // reads (multiAgentRunId, workerIds/membershipIds/dispatchIds,
-    // sandboxProfileChoices, expectedReturnShape).
-    const fanout = mai.createAgentFanout(run, {
-        id: optionalString(args.id) ?? fanoutId,
-        multiAgentRunId: multiAgentRunArg(args),
-        groupId: requireArg(groupId, "group id"),
-        reason: requireArg(args.reason, "reason"),
-        roleIds: arrayArg(args.role ?? args.roleId ?? args.roles),
-        taskIds: arrayArg(args.task ?? args.taskId ?? args.tasks),
-        workerIds: arrayArg(args.worker ?? args.workerId ?? args.workers),
-        membershipIds: arrayArg(args.membership ?? args.membershipId ?? args.memberships),
-        dispatchIds: arrayArg(args.dispatch ?? args.dispatchId ?? args.dispatches),
-        concurrencyLimit: numberArg(args.limit ?? args.concurrency ?? args.concurrencyLimit),
-        sandboxProfileChoices: parseSandboxChoicesCli(args),
-        expectedReturnShape: optionalString(args.expectedReturnShape ?? args["expected-return-shape"]),
-        blackboardId: blackboardIdArg(args),
-        topicIds: topicIdsArg(args),
     });
-    persist(run);
-    return fanout;
 }
 function multiAgentFaninCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const faninId = optionalString(args.faninId);
-    const groupId = groupArg(args);
-    const fanoutId = optionalString(args.fanoutId ?? args.fanout);
-    if (faninId && !args.id && !groupId && !fanoutId) {
-        const fanin = (0, runtime_1.getAgentFanin)(run, faninId);
-        if (!fanin)
-            throw new Error(`Unknown AgentFanin id: ${faninId}`);
+    return mutateRun(args, runId, (run) => {
+        const faninId = optionalString(args.faninId);
+        const groupId = groupArg(args);
+        const fanoutId = optionalString(args.fanoutId ?? args.fanout);
+        if (faninId && !args.id && !groupId && !fanoutId) {
+            const fanin = (0, runtime_1.getAgentFanin)(run, faninId);
+            if (!fanin)
+                throw new Error(`Unknown AgentFanin id: ${faninId}`);
+            return fanin;
+        }
+        // #29: `--required-role` folds to the kebab key `required-role`; read the
+        // kebab + camelCase aliases. #28: forward `--blackboard`/`--topic` +
+        // multiAgentRunId. Byte-exact to the old collectAgentFanin option map.
+        const fanin = mai.collectAgentFanin(run, {
+            id: optionalString(args.id) ?? faninId,
+            multiAgentRunId: multiAgentRunArg(args),
+            groupId,
+            fanoutId,
+            requiredRoleIds: arrayArg(args.requiredRole ?? args.requiredRoleId ?? args["required-role"]),
+            strategy: optionalString(args.strategy),
+            blackboardId: blackboardIdArg(args),
+            topicIds: topicIdsArg(args),
+        });
+        persist(run);
         return fanin;
-    }
-    // #29: `--required-role` folds to the kebab key `required-role`; read the
-    // kebab + camelCase aliases. #28: forward `--blackboard`/`--topic` +
-    // multiAgentRunId. Byte-exact to the old collectAgentFanin option map.
-    const fanin = mai.collectAgentFanin(run, {
-        id: optionalString(args.id) ?? faninId,
-        multiAgentRunId: multiAgentRunArg(args),
-        groupId,
-        fanoutId,
-        requiredRoleIds: arrayArg(args.requiredRole ?? args.requiredRoleId ?? args["required-role"]),
-        strategy: optionalString(args.strategy),
-        blackboardId: blackboardIdArg(args),
-        topicIds: topicIdsArg(args),
     });
-    persist(run);
-    return fanin;
 }
 function multiAgentShowCli(args, id) {
     const runId = requireArg(args.runId, "run id");
@@ -736,24 +768,27 @@ function blackboardGraphCli(args) {
 }
 function blackboardResolveCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const board = coord.resolveBlackboard(run, { id: optionalString(args.id), title: optionalString(args.title), multiAgentRunId: optionalString(args.multiAgentRunId), groupId: optionalString(args.groupId), roleId: optionalString(args.roleId), membershipId: optionalString(args.membershipId) });
-    persist(run);
-    return board;
+    return mutateRun(args, runId, (run) => {
+        const board = coord.resolveBlackboard(run, { id: optionalString(args.id), title: optionalString(args.title), multiAgentRunId: optionalString(args.multiAgentRunId), groupId: optionalString(args.groupId), roleId: optionalString(args.roleId), membershipId: optionalString(args.membershipId) });
+        persist(run);
+        return board;
+    });
 }
 function blackboardTopicCreateCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const topic = coord.createBlackboardTopic(run, { id: optionalString(args.id), title: requireArg(args.title, "topic title"), description: optionalString(args.description), blackboardId: optionalString(args.blackboardId), author: parseBlackboardAuthorCli(args), scope: parseBlackboardScopeCli(args), tags: arrayArg(args.tag) });
-    persist(run);
-    return topic;
+    return mutateRun(args, runId, (run) => {
+        const topic = coord.createBlackboardTopic(run, { id: optionalString(args.id), title: requireArg(args.title, "topic title"), description: optionalString(args.description), blackboardId: optionalString(args.blackboardId), author: parseBlackboardAuthorCli(args), scope: parseBlackboardScopeCli(args), tags: arrayArg(args.tag) });
+        persist(run);
+        return topic;
+    });
 }
 function blackboardMessagePostCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const message = coord.postBlackboardMessage(run, { id: optionalString(args.id), topicId: requireArg(args.topic ?? args.topicId, "topic id"), blackboardId: optionalString(args.blackboardId), body: requireArg(args.body, "message body"), replyToId: optionalString(args.replyTo), visibility: optionalString(args.visibility), author: parseBlackboardAuthorCli(args), scope: parseBlackboardScopeCli(args), links: parseBlackboardLinksCli(runId, args), tags: arrayArg(args.tag), evidenceRefs: arrayArg(args.evidence), artifactRefIds: arrayArg(args.artifact) });
-    persist(run);
-    return message;
+    return mutateRun(args, runId, (run) => {
+        const message = coord.postBlackboardMessage(run, { id: optionalString(args.id), topicId: requireArg(args.topic ?? args.topicId, "topic id"), blackboardId: optionalString(args.blackboardId), body: requireArg(args.body, "message body"), replyToId: optionalString(args.replyTo), visibility: optionalString(args.visibility), author: parseBlackboardAuthorCli(args), scope: parseBlackboardScopeCli(args), links: parseBlackboardLinksCli(runId, args), tags: arrayArg(args.tag), evidenceRefs: arrayArg(args.evidence), artifactRefIds: arrayArg(args.artifact) });
+        persist(run);
+        return message;
+    });
 }
 function blackboardMessageListCli(args) {
     const runId = requireArg(args.runId, "run id");
@@ -762,17 +797,19 @@ function blackboardMessageListCli(args) {
 }
 function blackboardContextPutCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const context = coord.putBlackboardContext(run, { id: optionalString(args.id), topicId: requireArg(args.topic ?? args.topicId, "topic id"), kind: requireArg(args.kind, "context kind"), key: optionalString(args.key), value: requireArg(args.value ?? args.body, "context value"), blackboardId: optionalString(args.blackboardId), supersedesContextIds: arrayArg(args.supersedes), author: parseBlackboardAuthorCli(args), scope: parseBlackboardScopeCli(args), links: parseBlackboardLinksCli(runId, args), tags: arrayArg(args.tag), evidenceRefs: arrayArg(args.evidence), artifactRefIds: arrayArg(args.artifact) });
-    persist(run);
-    return context;
+    return mutateRun(args, runId, (run) => {
+        const context = coord.putBlackboardContext(run, { id: optionalString(args.id), topicId: requireArg(args.topic ?? args.topicId, "topic id"), kind: requireArg(args.kind, "context kind"), key: optionalString(args.key), value: requireArg(args.value ?? args.body, "context value"), blackboardId: optionalString(args.blackboardId), supersedesContextIds: arrayArg(args.supersedes), author: parseBlackboardAuthorCli(args), scope: parseBlackboardScopeCli(args), links: parseBlackboardLinksCli(runId, args), tags: arrayArg(args.tag), evidenceRefs: arrayArg(args.evidence), artifactRefIds: arrayArg(args.artifact) });
+        persist(run);
+        return context;
+    });
 }
 function blackboardArtifactAddCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const artifact = coord.addBlackboardArtifact(run, { id: optionalString(args.id), topicId: optionalString(args.topic ?? args.topicId), kind: requireArg(args.kind, "artifact kind"), path: optionalString(args.path), locator: optionalString(args.locator), blackboardId: optionalString(args.blackboardId), source: optionalString(args.source), author: parseBlackboardAuthorCli(args), scope: parseBlackboardScopeCli(args), links: parseBlackboardLinksCli(runId, args), tags: arrayArg(args.tag), evidenceRefs: arrayArg(args.evidence) });
-    persist(run);
-    return artifact;
+    return mutateRun(args, runId, (run) => {
+        const artifact = coord.addBlackboardArtifact(run, { id: optionalString(args.id), topicId: optionalString(args.topic ?? args.topicId), kind: requireArg(args.kind, "artifact kind"), path: optionalString(args.path), locator: optionalString(args.locator), blackboardId: optionalString(args.blackboardId), source: optionalString(args.source), author: parseBlackboardAuthorCli(args), scope: parseBlackboardScopeCli(args), links: parseBlackboardLinksCli(runId, args), tags: arrayArg(args.tag), evidenceRefs: arrayArg(args.evidence) });
+        persist(run);
+        return artifact;
+    });
 }
 function blackboardArtifactListCli(args) {
     const runId = requireArg(args.runId, "run id");
@@ -781,10 +818,11 @@ function blackboardArtifactListCli(args) {
 }
 function blackboardSnapshotCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const snapshot = coord.createBlackboardSnapshot(run, optionalString(args.blackboardId));
-    persist(run);
-    return snapshot;
+    return mutateRun(args, runId, (run) => {
+        const snapshot = coord.createBlackboardSnapshot(run, optionalString(args.blackboardId));
+        persist(run);
+        return snapshot;
+    });
 }
 function coordinatorSummaryCli(args) {
     const runId = requireArg(args.runId, "run id");
@@ -793,10 +831,11 @@ function coordinatorSummaryCli(args) {
 }
 function coordinatorDecisionCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const decision = coord.recordCoordinatorDecision(run, { id: optionalString(args.id), blackboardId: optionalString(args.blackboardId), kind: requireArg(args.kind, "decision kind"), outcome: requireArg(args.outcome, "decision outcome"), reason: requireArg(args.reason, "decision reason"), subjectIds: arrayArg(args.subject), evidenceRefs: arrayArg(args.evidence), artifactRefIds: arrayArg(args.artifact), messageIds: arrayArg(args.message) });
-    persist(run);
-    return decision;
+    return mutateRun(args, runId, (run) => {
+        const decision = coord.recordCoordinatorDecision(run, { id: optionalString(args.id), blackboardId: optionalString(args.blackboardId), kind: requireArg(args.kind, "decision kind"), outcome: requireArg(args.outcome, "decision outcome"), reason: requireArg(args.reason, "decision reason"), subjectIds: arrayArg(args.subject), evidenceRefs: arrayArg(args.evidence), artifactRefIds: arrayArg(args.artifact), messageIds: arrayArg(args.message) });
+        persist(run);
+        return decision;
+    });
 }
 // ---------------------------------------------------------------------------
 // Candidate scoring
@@ -816,33 +855,34 @@ function candidateShowCli(args, candidateId) {
 }
 function candidateRegisterCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    // `candidate register --worker <id>` — derive the worker's accepted
-    // result/verifier state nodes (and result path) from the worker scope +
-    // its backing task, so a candidate registered from a verified worker
-    // carries the verifier gate the selection gate requires. Port of the old
-    // orchestrator/candidate-operations.ts registerCandidate worker read
-    // (v2's candidateRegisterCli only forwarded --result-node/--verifier-node).
-    const workerId = optionalString(args.worker ?? args.workerId);
-    const worker = workerId ? (0, worker_isolation_1.getWorkerScope)(run, workerId) : undefined;
-    if (workerId && !worker)
-        throw new Error(`Unknown worker id for run ${run.id}: ${workerId}`);
-    const workerOutput = worker?.output;
-    const task = worker ? run.tasks.find((entry) => entry.id === worker.taskId) : undefined;
-    const resultNodeId = optionalString(args.resultNode) || worker?.resultNodeId || task?.resultNodeId;
-    const verifierNodeId = optionalString(args.verifierNode) || workerOutput?.verifierNodeId || task?.verifierNodeId;
-    const resultPath = optionalString(args.resultPath) || workerOutput?.resultPath || task?.resultPath;
-    const candidate = cs.registerCandidate(run, {
-        id: optionalString(args.id),
-        kind: optionalString(args.kind),
-        workerId,
-        taskId: optionalString(args.task ?? args.taskId) || worker?.taskId,
-        resultNodeId,
-        verifierNodeId,
-        resultPath,
+    return mutateRun(args, runId, (run) => {
+        // `candidate register --worker <id>` — derive the worker's accepted
+        // result/verifier state nodes (and result path) from the worker scope +
+        // its backing task, so a candidate registered from a verified worker
+        // carries the verifier gate the selection gate requires. Port of the old
+        // orchestrator/candidate-operations.ts registerCandidate worker read
+        // (v2's candidateRegisterCli only forwarded --result-node/--verifier-node).
+        const workerId = optionalString(args.worker ?? args.workerId);
+        const worker = workerId ? (0, worker_isolation_1.getWorkerScope)(run, workerId) : undefined;
+        if (workerId && !worker)
+            throw new Error(`Unknown worker id for run ${run.id}: ${workerId}`);
+        const workerOutput = worker?.output;
+        const task = worker ? run.tasks.find((entry) => entry.id === worker.taskId) : undefined;
+        const resultNodeId = optionalString(args.resultNode) || worker?.resultNodeId || task?.resultNodeId;
+        const verifierNodeId = optionalString(args.verifierNode) || workerOutput?.verifierNodeId || task?.verifierNodeId;
+        const resultPath = optionalString(args.resultPath) || workerOutput?.resultPath || task?.resultPath;
+        const candidate = cs.registerCandidate(run, {
+            id: optionalString(args.id),
+            kind: optionalString(args.kind),
+            workerId,
+            taskId: optionalString(args.task ?? args.taskId) || worker?.taskId,
+            resultNodeId,
+            verifierNodeId,
+            resultPath,
+        });
+        persist(run);
+        return candidate;
     });
-    persist(run);
-    return candidate;
 }
 function parseCriteriaCli(args) {
     const criteria = {};
@@ -868,32 +908,36 @@ function parseCriteriaCli(args) {
 }
 function candidateScoreCli(args, candidateId) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const evidence = arrayArg(args.evidence).map((entry, index) => ({ id: `score:${index + 1}`, source: "cli", locator: entry, summary: entry }));
-    const score = cs.scoreCandidate(run, candidateId, { id: optionalString(args.id), scorer: optionalString(args.scorer), criteria: parseCriteriaCli(args), maxTotal: numberArg(args.maxTotal ?? args.max), verdict: optionalString(args.verdict), evidence, notes: optionalString(args.notes) });
-    persist(run);
-    return score;
+    return mutateRun(args, runId, (run) => {
+        const evidence = arrayArg(args.evidence).map((entry, index) => ({ id: `score:${index + 1}`, source: "cli", locator: entry, summary: entry }));
+        const score = cs.scoreCandidate(run, candidateId, { id: optionalString(args.id), scorer: optionalString(args.scorer), criteria: parseCriteriaCli(args), maxTotal: numberArg(args.maxTotal ?? args.max), verdict: optionalString(args.verdict), evidence, notes: optionalString(args.notes) });
+        persist(run);
+        return score;
+    });
 }
 function candidateRankCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const ranking = cs.rankCandidates(run, { includeRejected: boolArg(args.includeRejected), policy: { minNormalized: numberArg(args.minNormalized), requireEvidence: args.requireEvidence === undefined ? undefined : boolArg(args.requireEvidence), requireVerifierGate: args.requireVerifierGate === undefined ? undefined : boolArg(args.requireVerifierGate), tieBreaker: optionalString(args.tieBreaker) } });
-    persist(run);
-    return ranking;
+    return mutateRun(args, runId, (run) => {
+        const ranking = cs.rankCandidates(run, { includeRejected: boolArg(args.includeRejected), policy: { minNormalized: numberArg(args.minNormalized), requireEvidence: args.requireEvidence === undefined ? undefined : boolArg(args.requireEvidence), requireVerifierGate: args.requireVerifierGate === undefined ? undefined : boolArg(args.requireVerifierGate), tieBreaker: optionalString(args.tieBreaker) } });
+        persist(run);
+        return ranking;
+    });
 }
 function candidateSelectCli(args, candidateId) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const selection = cs.selectCandidate(run, candidateId, { selectedBy: optionalString(args.selectedBy ?? args.by), reason: optionalString(args.reason), scoreId: optionalString(args.score), allowUnverified: boolArg(args.allowUnverified) }, { policy: { minNormalized: numberArg(args.minNormalized), requireVerifierGate: args.requireVerifierGate === undefined ? undefined : boolArg(args.requireVerifierGate) } });
-    persist(run);
-    return selection;
+    return mutateRun(args, runId, (run) => {
+        const selection = cs.selectCandidate(run, candidateId, { selectedBy: optionalString(args.selectedBy ?? args.by), reason: optionalString(args.reason), scoreId: optionalString(args.score), allowUnverified: boolArg(args.allowUnverified) }, { policy: { minNormalized: numberArg(args.minNormalized), requireVerifierGate: args.requireVerifierGate === undefined ? undefined : boolArg(args.requireVerifierGate) } });
+        persist(run);
+        return selection;
+    });
 }
 function candidateRejectCli(args, candidateId) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const candidate = cs.rejectCandidate(run, candidateId, requireArg(args.reason, "reject reason"));
-    persist(run);
-    return candidate;
+    return mutateRun(args, runId, (run) => {
+        const candidate = cs.rejectCandidate(run, candidateId, requireArg(args.reason, "reject reason"));
+        persist(run);
+        return candidate;
+    });
 }
 function candidateSummaryCli(args) {
     const runId = requireArg(args.runId, "run id");
@@ -915,24 +959,24 @@ function targetFromArgs(args, positionalKind, positionalId) {
 }
 function approveCli(args, positionalKind, positionalId) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const target = targetFromArgs(args, positionalKind, positionalId);
-    const record = collab.recordApproval(run, { target: target, decision: "approve", actor: optionalString(args.actor), actorKind: optionalString(args.actorKind), role: optionalString(args.role), displayName: optionalString(args.displayName), attested: boolArg(args.attested), attestation: optionalString(args.attestation), rationale: optionalString(args.rationale), supersedes: optionalString(args.supersedes) });
-    return record;
+    return mutateRun(args, runId, (run) => {
+        const target = targetFromArgs(args, positionalKind, positionalId);
+        return collab.recordApproval(run, { target: target, decision: "approve", actor: optionalString(args.actor), actorKind: optionalString(args.actorKind), role: optionalString(args.role), displayName: optionalString(args.displayName), attested: boolArg(args.attested), attestation: optionalString(args.attestation), rationale: optionalString(args.rationale), supersedes: optionalString(args.supersedes) });
+    });
 }
 function rejectCollabCli(args, positionalKind, positionalId) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const target = targetFromArgs(args, positionalKind, positionalId);
-    const record = collab.recordApproval(run, { target: target, decision: "reject", actor: optionalString(args.actor), actorKind: optionalString(args.actorKind), role: optionalString(args.role), displayName: optionalString(args.displayName), attested: boolArg(args.attested), attestation: optionalString(args.attestation), rationale: optionalString(args.rationale) });
-    return record;
+    return mutateRun(args, runId, (run) => {
+        const target = targetFromArgs(args, positionalKind, positionalId);
+        return collab.recordApproval(run, { target: target, decision: "reject", actor: optionalString(args.actor), actorKind: optionalString(args.actorKind), role: optionalString(args.role), displayName: optionalString(args.displayName), attested: boolArg(args.attested), attestation: optionalString(args.attestation), rationale: optionalString(args.rationale) });
+    });
 }
 function commentAddCli(args, positionalKind, positionalId) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const target = targetFromArgs(args, positionalKind, positionalId);
-    const record = collab.recordComment(run, { target: target, body: requireArg(args.body ?? args.message ?? args.text, "comment body"), actor: optionalString(args.actor), actorKind: optionalString(args.actorKind), role: optionalString(args.role), threadId: optionalString(args.thread), parentId: optionalString(args.parent) });
-    return record;
+    return mutateRun(args, runId, (run) => {
+        const target = targetFromArgs(args, positionalKind, positionalId);
+        return collab.recordComment(run, { target: target, body: requireArg(args.body ?? args.message ?? args.text, "comment body"), actor: optionalString(args.actor), actorKind: optionalString(args.actorKind), role: optionalString(args.role), threadId: optionalString(args.thread), parentId: optionalString(args.parent) });
+    });
 }
 function commentListCli(args) {
     const runId = requireArg(args.runId, "run id");
@@ -943,10 +987,10 @@ function commentListCli(args) {
 }
 function handoffCli(args, positionalKind, positionalId) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    const target = targetFromArgs(args, positionalKind, positionalId);
-    const record = collab.recordHandoff(run, { target: target, toActor: optionalString(args.to ?? args.toActor), toRole: optionalString(args.toRole), fromActor: optionalString(args.from), reason: requireArg(args.reason, "handoff reason"), actor: optionalString(args.actor), actorKind: optionalString(args.actorKind), role: optionalString(args.role) });
-    return record;
+    return mutateRun(args, runId, (run) => {
+        const target = targetFromArgs(args, positionalKind, positionalId);
+        return collab.recordHandoff(run, { target: target, toActor: optionalString(args.to ?? args.toActor), toRole: optionalString(args.toRole), fromActor: optionalString(args.from), reason: requireArg(args.reason, "handoff reason"), actor: optionalString(args.actor), actorKind: optionalString(args.actorKind), role: optionalString(args.role) });
+    });
 }
 function reviewStatusCli(args) {
     const runId = requireArg(args.runId, "run id");
@@ -957,19 +1001,19 @@ function reviewStatusCli(args) {
 }
 function reviewPolicyCli(args) {
     const runId = requireArg(args.runId, "run id");
-    const run = loadRun(args, runId);
-    // Read BOTH the MCP camelCase keys and the CLI kebab-case flags: the CLI
-    // parser emits `--required-approvals` as `required-approvals`, not
-    // `requiredApprovals`, so without the fallback every flag was silently
-    // dropped and the CLI wrote the default policy (caught by parity-check's
-    // cw --json vs cw_review_policy payload probe).
-    const requiredApprovals = args.requiredApprovals ?? args["required-approvals"];
-    const authorizedRoles = args.authorizedRoles ?? args["authorized-roles"];
-    const allowSelfApproval = args.allowSelfApproval ?? args["allow-self-approval"];
-    const requireAttestedActor = args.requireAttestedActor ?? args["require-attested-actor"];
-    const appliesTo = args.appliesTo ?? args["applies-to"];
-    const policy = collab.setReviewPolicy(run, { requiredApprovals: numberArg(requiredApprovals), authorizedRoles: arrayArg(authorizedRoles).length ? arrayArg(authorizedRoles) : optionalString(authorizedRoles), allowSelfApproval: allowSelfApproval === undefined ? undefined : boolArg(allowSelfApproval), requireAttestedActor: requireAttestedActor === undefined ? undefined : boolArg(requireAttestedActor), appliesTo: arrayArg(appliesTo).length ? arrayArg(appliesTo) : optionalString(appliesTo) });
-    return policy;
+    return mutateRun(args, runId, (run) => {
+        // Read BOTH the MCP camelCase keys and the CLI kebab-case flags: the CLI
+        // parser emits `--required-approvals` as `required-approvals`, not
+        // `requiredApprovals`, so without the fallback every flag was silently
+        // dropped and the CLI wrote the default policy (caught by parity-check's
+        // cw --json vs cw_review_policy payload probe).
+        const requiredApprovals = args.requiredApprovals ?? args["required-approvals"];
+        const authorizedRoles = args.authorizedRoles ?? args["authorized-roles"];
+        const allowSelfApproval = args.allowSelfApproval ?? args["allow-self-approval"];
+        const requireAttestedActor = args.requireAttestedActor ?? args["require-attested-actor"];
+        const appliesTo = args.appliesTo ?? args["applies-to"];
+        return collab.setReviewPolicy(run, { requiredApprovals: numberArg(requiredApprovals), authorizedRoles: arrayArg(authorizedRoles).length ? arrayArg(authorizedRoles) : optionalString(authorizedRoles), allowSelfApproval: allowSelfApproval === undefined ? undefined : boolArg(allowSelfApproval), requireAttestedActor: requireAttestedActor === undefined ? undefined : boolArg(requireAttestedActor), appliesTo: arrayArg(appliesTo).length ? arrayArg(appliesTo) : optionalString(appliesTo) });
+    });
 }
 // ---------------------------------------------------------------------------
 // Eval replay