@khoavu882/doflow 2.0.0-beta.3 → 2.0.0-beta.5

package/src/lifecycle/{index.ts → index.js}

@@ -8,52 +8,53 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
-const { harnessFor, selectAssets, selectMcpServers, mcpCapable } = require('../registry/index.ts');
-const { defaultLedger, ownershipKey, writeLedger, writeRecoveryRecord, upgradeLedger, LEDGER_VERSION } = require('../state/index.ts');
-const { resolveAdapter, projectAdapterInput } = require('../adapters/index.ts');
-const { pruneEmptyAncestors, discoverTree, sameFileIndex, sharedTreeDestDir, walkRelFiles } = require('../adapters/copy-tree.ts');
-const { renderPolicies } = require('./policies.ts');
-const { renderMcpIndex } = require('./mcp-index.ts');
-const { hasBashCapableShell } = require('./bash-availability.ts');
-const { hookTrustFor: geminiHookTrustFor } = require('../adapters/gemini/index.ts');
+const { harnessFor, selectAssets, selectMcpServers, mcpCapable } = require('../registry/index.js');
+const { defaultLedger, ownershipKey, writeLedger, writeRecoveryRecord, upgradeLedger, LEDGER_VERSION } = require('../state/index.js');
+const { resolveAdapter, projectAdapterInput } = require('../adapters/index.js');
+const { pruneEmptyAncestors, discoverTree, sameFileIndex, sharedTreeDestDir, walkRelFiles } = require('../adapters/copy-tree.js');
+const { renderPolicies } = require('./policies.js');
+const { renderMcpIndex } = require('./mcp-index.js');
+const { hasBashCapableShell } = require('./bash-availability.js');
+const { hookTrustFor: geminiHookTrustFor } = require('../adapters/gemini/index.js');
+const { planHookCompanions } = require('./hook-step.js');
 
 const OPERATIONS = new Set(['create', 'merge', 'update', 'remove']);
 /** A harness's MCP selection meaning "the servers it owns now", read through its adapter's
  * `discover().mcpOwned`. */
 const MCP_KEEP = 'keep';
 
-function registryScope(scope: any) { return scope === 'global' ? 'user' : scope; }
-function assertScope(scope: any) {
+function registryScope(scope     ) { return scope === 'global' ? 'user' : scope; }
+function assertScope(scope     ) {
   if (scope !== 'project' && scope !== 'global') throw new Error(`Lifecycle scope must be project or global, got '${scope}'`);
 }
 
-function normalizeTargets(registry: any, targets: any) {
-  const wanted = targets && targets.length ? targets : registry.harnesses.map((harness: any) => harness.id);
+function normalizeTargets(registry     , targets     ) {
+  const wanted = targets && targets.length ? targets : registry.harnesses.map((harness     ) => harness.id);
   if (!Array.isArray(wanted)) throw new Error('Lifecycle targets must be an array');
   return [...new Set(wanted)].map((id) => harnessFor(registry, id));
 }
 
-function identityFor(change: any) { return change.ownershipIdentity ?? change.ownership; }
+function identityFor(change     ) { return change.ownershipIdentity ?? change.ownership; }
 
-function normalizeChange(change: any, { harness, assets }: any) {
+function normalizeChange(change     , { harness, assets }     ) {
   if (!change || typeof change !== 'object') throw new Error(`Adapter '${harness.id}' returned a non-object change`);
   const ownershipIdentity = identityFor(change);
   if (change.harness !== undefined && change.harness !== harness.id) throw new Error(`Adapter '${harness.id}' returned a change for '${change.harness}'`);
-  if (!assets.some((asset: any) => asset.id === change.assetId)) throw new Error(`Adapter '${harness.id}' returned unknown asset '${change.assetId}'`);
+  if (!assets.some((asset     ) => asset.id === change.assetId)) throw new Error(`Adapter '${harness.id}' returned unknown asset '${change.assetId}'`);
   if (!OPERATIONS.has(change.operation)) throw new Error(`Adapter '${harness.id}' returned unsupported operation '${change.operation}'`);
   if (typeof change.target !== 'string' || !change.target) throw new Error(`Adapter '${harness.id}' change '${change.assetId}' requires target`);
   if (typeof ownershipIdentity !== 'string' || !ownershipIdentity) throw new Error(`Adapter '${harness.id}' change '${change.assetId}' requires ownershipIdentity`);
   return Object.freeze({ ...change, harness: harness.id, ownershipIdentity });
 }
 
-function normalizeVerification(result: any, harness: any) {
+function normalizeVerification(result     , harness     ) {
   if (!result || typeof result !== 'object') throw new Error(`Adapter '${harness.id}' returned an invalid verification result`);
   const statuses = Array.isArray(result.statuses) ? result.statuses : [];
   const resources = Array.isArray(result.resources) ? result.resources : [];
   return { ...result, harness: harness.id, statuses, resources };
 }
 
-function matchesChange(resource: any, change: any) {
+function matchesChange(resource     , change     ) {
   if (resource?.assetId !== change.assetId || resource?.target !== change.target) return false;
   const resourceOwnership = resource?.ownershipIdentity ?? resource?.ownership;
   const changeOwnership = change.ownershipIdentity ?? change.ownership;
@@ -68,9 +69,9 @@ function matchesChange(resource: any, change: any) {
 /** Whether one removed change is genuinely gone, and if so, how `statuses` should record that.
  * `statuses` is read live, not a snapshot — an earlier change in the same removal batch can add
  * or update an entry a later change's own lookup then finds. */
-function reconcileRemovedChange(verification: any, statuses: any, change: any) {
-  const reported = verification.resources.some((resource: any) => matchesChange(resource, change));
-  const statusIndex = statuses.findIndex((item: any) => matchesChange(item, change));
+function reconcileRemovedChange(verification     , statuses     , change     ) {
+  const reported = verification.resources.some((resource     ) => matchesChange(resource, change));
+  const statusIndex = statuses.findIndex((item     ) => matchesChange(item, change));
   const status = statusIndex >= 0 ? statuses[statusIndex] : null;
   // 'absent' belongs here alongside 'missing': a shared file (settings.json) survives removal
   // holding the user's own content, and its adapter reports 'absent' once none of DoFlow's
@@ -101,28 +102,28 @@ function reconcileRemovedChange(verification: any, statuses: any, change: any) {
  * 'missing' the ledger *does* claim stays a hard failure — that is a removal which genuinely did
  * not happen, and the existing "unrelated missing remains false" contract depends on it. Without a
  * ledger, non-ownership cannot be proven, so the strict reading is kept. */
-function markUnownedAbsences(statuses: any, ledger: any, harness: any) {
+function markUnownedAbsences(statuses     , ledger     , harness     ) {
   if (!ledger) return statuses;
   const owned = new Set((ledger.resources || [])
-    .filter((resource: any) => resource.harness === harness)
-    .map((resource: any) => resource.ownershipIdentity)
+    .filter((resource     ) => resource.harness === harness)
+    .map((resource     ) => resource.ownershipIdentity)
     .filter(Boolean));
-  return statuses.map((status: any) => (
+  return statuses.map((status     ) => (
     status?.status === 'missing' && status.ownershipIdentity && !owned.has(status.ownershipIdentity)
       ? { ...status, status: 'absent', expectedAbsence: true }
       : status
   ));
 }
 
-function normalizeRemovalVerification(verification: any, changes: any, ledger: any) {
-  const removals = changes.filter((change: any) => change.operation === 'remove' && change.harness === verification.harness);
+function normalizeRemovalVerification(verification     , changes     , ledger     ) {
+  const removals = changes.filter((change     ) => change.operation === 'remove' && change.harness === verification.harness);
   if (!removals.length) return verification;
   // A retained removal released this harness's ownership row without deleting the file, because
   // another harness still claims it (see markRetainedRemovals). The file is therefore *expected*
   // to still be on disk, so asking "is it gone?" of it would turn the correct outcome into a
   // verification conflict. Everything the plan actually deleted is still checked as strictly as
   // before.
-  const removed = removals.filter((change: any) => !change.retained);
+  const removed = removals.filter((change     ) => !change.retained);
   let statuses = [...verification.statuses];
   const conflicts = [...(verification.conflicts || [])];
   for (const change of removed) {
@@ -140,35 +141,35 @@ function normalizeRemovalVerification(verification: any, changes: any, ledger: a
  * that exact absence has been normalized (an `expectedRemoval` status), recompute rather than
  * carrying the stale false forward. A bare adapter failure, conflict, or any unrelated
  * missing/error status remains a hard verification failure. */
-function removalVerificationOk(ok: any, statuses: any, conflicts: any) {
-  const unresolvedFailure = statuses.some((status: any) => ['missing', 'conflict', 'error', 'invalid'].includes(status?.status));
-  const onlyExpectedRemovalFailure = ok === false && statuses.some((status: any) => status?.expectedRemoval || status?.expectedAbsence) && !unresolvedFailure && conflicts.length === 0;
+function removalVerificationOk(ok     , statuses     , conflicts     ) {
+  const unresolvedFailure = statuses.some((status     ) => ['missing', 'conflict', 'error', 'invalid'].includes(status?.status));
+  const onlyExpectedRemovalFailure = ok === false && statuses.some((status     ) => status?.expectedRemoval || status?.expectedAbsence) && !unresolvedFailure && conflicts.length === 0;
   return conflicts.length === 0 && !unresolvedFailure && (ok !== false || onlyExpectedRemovalFailure);
 }
 
 /** A `failures` entry comes in three shapes from different adapters: a [name, detail] tuple,
  * a bare string, or an object with its own conflicts/errors. */
-function failureReasons(failure: any) {
+function failureReasons(failure     ) {
   if (Array.isArray(failure)) {
     const [name, detail] = failure;
     const detailReasons = detail?.conflicts || detail?.errors || [];
-    return detailReasons.map((reason: any) => `${name}: ${reason}`);
+    return detailReasons.map((reason     ) => `${name}: ${reason}`);
   }
   if (typeof failure === 'string') return [failure];
   if (failure?.conflicts || failure?.errors) return failure.conflicts || failure.errors;
   return [];
 }
 
-function componentReasons(name: any, component: any) {
+function componentReasons(name     , component     ) {
   if (component?.ok !== false) return [];
   const details = component.conflicts || component.errors || [];
-  return details.length ? details.map((reason: any) => `${name}: ${reason}`) : [`${name}: native plan failed`];
+  return details.length ? details.map((reason     ) => `${name}: ${reason}`) : [`${name}: native plan failed`];
 }
 
 /** Promote adapter-declared failed components into the common conflict channel.
  * A false `ok` is never advisory: otherwise a native adapter can decline a
  * dangerous reconciliation while the lifecycle still journals and writes state. */
-function adapterConflicts(result: any, harness: any) {
+function adapterConflicts(result     , harness     ) {
   const reasons = [
     ...(result.conflicts || []),
     ...(result.errors || []),
@@ -182,7 +183,7 @@ function adapterConflicts(result: any, harness: any) {
 /** Every ownership row this plan is about to give up, keyed exactly as the neutral ledger keys it.
  * A removal change always releases its harness's claim; whether it also deletes the file is a
  * separate question, answered by markRetainedRemovals below. */
-function releasedOwnershipKeys(harnessPlans: any, scope: any) {
+function releasedOwnershipKeys(harnessPlans     , scope     ) {
   const keys = new Set();
   for (const target of harnessPlans) {
     for (const change of target.changes || []) {
@@ -199,7 +200,7 @@ function releasedOwnershipKeys(harnessPlans: any, scope: any) {
  * on this file is not a claimant even if it is releasing nothing else, and a harness in the same
  * batch that keeps its row (an install that relocates one asset while a sibling's projection is
  * unchanged) still is. */
-function survivingClaimantsByTarget(ledger: any, releasedKeys: any) {
+function survivingClaimantsByTarget(ledger     , releasedKeys     ) {
   const byTarget = new Map();
   for (const resource of ledger?.resources || []) {
     if (typeof resource?.target !== 'string' || typeof resource?.harness !== 'string') continue;
@@ -213,7 +214,7 @@ function survivingClaimantsByTarget(ledger: any, releasedKeys: any) {
 
 /** What one claim covers: a whole file, except an MCP entry, which is claimed on its own because
  * several harnesses keep their servers side by side in one MCP file. */
-function claimKey(record: any) {
+function claimKey(record     ) {
   return record.kind === 'mcp-server' ? `${record.target}\u0000${record.identity}` : record.target;
 }
 
@@ -232,13 +233,13 @@ function claimKey(record: any) {
  * stays, and the last claimant's removal is the one that reclaims it. The neutral ledger is the
  * only thing consulted — it is already the record of who owns what, and a second ownership
  * registry would be one more thing to keep in sync. */
-function markRetainedRemovals(harnessPlans: any, ledger: any, scope: any) {
+function markRetainedRemovals(harnessPlans     , ledger     , scope     ) {
   const claimants = survivingClaimantsByTarget(ledger, releasedOwnershipKeys(harnessPlans, scope));
   if (!claimants.size) return harnessPlans;
-  return harnessPlans.map((target: any) => {
+  return harnessPlans.map((target     ) => {
     if (target.skipped) return target;
     let retainedAny = false;
-    const changes = target.changes.map((change: any) => {
+    const changes = target.changes.map((change     ) => {
       if (change.operation !== 'remove') return change;
       const retainedFor = [...(claimants.get(claimKey(change)) ?? [])].filter((harness) => harness !== change.harness).sort();
       if (!retainedFor.length) return change;
@@ -255,15 +256,15 @@ function markRetainedRemovals(harnessPlans: any, ledger: any, scope: any) {
 
 /** Whether this plan leaves no ownership row standing anywhere — the only case in which a shared,
  * install-wide artifact that no single harness owns is genuinely unclaimed. */
-function removalIsTotal(plan: any) {
+function removalIsTotal(plan     ) {
   const released = releasedOwnershipKeys(plan.targets || [], plan.scope);
-  return (plan.ledger?.resources || []).every((resource: any) => released.has(ownershipKey(resource)));
+  return (plan.ledger?.resources || []).every((resource     ) => released.has(ownershipKey(resource)));
 }
 
 /** What a removal kept and why, ready to print. A command that says "removed" while silently
  * leaving files behind is answering confidently about something it did not do, so the retained
  * count and the harnesses responsible for it are reported, never inferred by the caller. */
-function retentionSummary(retained: any = []) {
+function retentionSummary(retained      = []) {
   const groups = new Map();
   for (const item of retained) {
     // No claimant: a release that is reported on its own line (a kept hand edit) or is silent
@@ -278,26 +279,26 @@ function retentionSummary(retained: any = []) {
   });
 }
 
-function retainedChanges(changes: any) {
-  return changes.filter((change: any) => change.retained)
-    .map((change: any) => ({ harness: change.harness, assetId: change.assetId, target: change.target, retainedFor: change.retainedFor }));
+function retainedChanges(changes     ) {
+  return changes.filter((change     ) => change.retained)
+    .map((change     ) => ({ harness: change.harness, assetId: change.assetId, target: change.target, retainedFor: change.retainedFor }));
 }
 
 /** An adapter's non-blocking notes: one line of at most 200 characters each. A malformed entry is
  * dropped rather than failing the plan, because a notice must never change whether an install runs. */
-function adapterNotices(result: any) {
+function adapterNotices(result     ) {
   return (Array.isArray(result.notices) ? result.notices : [])
-    .filter((notice: any) => typeof notice === 'string' && notice.length <= 200 && !/[\u0000-\u001f\u007f]/.test(notice));
+    .filter((notice     ) => typeof notice === 'string' && notice.length <= 200 && !/[\u0000-\u001f\u007f]/.test(notice));
 }
 
 /** The ids of `ids` the catalog declares, in registry order. */
-function catalogIds(registry: any, ids: any) {
-  return registry.mcp.filter((server: any) => ids.includes(server.id)).map((server: any) => server.id);
+function catalogIds(registry     , ids     ) {
+  return registry.mcp.filter((server     ) => ids.includes(server.id)).map((server     ) => server.id);
 }
 
 /** Each harness takes its own MCP selection: an id array, or MCP_KEEP for the servers it owns now.
  * A harness that takes no MCP servers reads `keep` and an absent entry as none and refuses any id. */
-function harnessMcpSelection(registry: any, harness: any, raw: any) {
+function harnessMcpSelection(registry     , harness     , raw     ) {
   const value = raw ?? [];
   if (value !== MCP_KEEP && !(Array.isArray(value) && value.every((id) => typeof id === 'string'))) {
     throw new Error(`MCP selection for '${harness.id}' must be an array of server ids or '${MCP_KEEP}'`);
@@ -315,22 +316,22 @@ function harnessMcpSelection(registry: any, harness: any, raw: any) {
  * right for them. */
 const RUNTIME_TREE_ASSETS = ['runtime.cli', 'runtime.lib', 'runtime.registry'];
 
-function sha256File(file: string, fsImpl: any): string {
+function sha256File(file        , fsImpl     )         {
   return crypto.createHash('sha256').update(fsImpl.readFileSync(file)).digest('hex');
 }
 
-function isUnder(file: string, root: string): boolean {
+function isUnder(file        , root        )          {
   return file.startsWith(`${root}${path.sep}`);
 }
 
 /** Replace some of a harness plan's changes and append others, keeping `requiredNativeResources`
  * in step: the same array when it is one (as markRetainedRemovals does), else with the added
  * changes listed, so a plan holding only those is still applicable (codex lists its own). */
-function withChanges(target: any, replaced: Map<any, any>, added: any[], notices: string[]) {
+function withChanges(target     , replaced               , added       , notices          ) {
   if (!replaced.size && !added.length && !notices.length) return target;
-  const changes = [...target.changes.map((change: any) => replaced.get(change) ?? change), ...added];
+  const changes = [...target.changes.map((change     ) => replaced.get(change) ?? change), ...added];
   const requiredNativeResources = target.requiredNativeResources === target.changes ? changes
-    : [...target.requiredNativeResources, ...added.map((change: any) => ({ harness: change.harness, component: 'runtimePrune', target: change.target, operation: change.operation, identity: change.identity }))];
+    : [...target.requiredNativeResources, ...added.map((change     ) => ({ harness: change.harness, component: 'runtimePrune', target: change.target, operation: change.operation, identity: change.identity }))];
   return { ...target, changes, requiredNativeResources, notices: [...target.notices, ...notices] };
 }
 
@@ -353,92 +354,92 @@ function withChanges(target: any, replaced: Map<any, any>, added: any[], notices
  * removeTree re-hashes every file just before deleting it, as for any removal, and for the removals
  * this pass plans (`pruneGuard`) re-runs the containment and same-file checks there too.
  */
-function pruneRetiredRuntimeFiles(harnessPlans: any[], ledger: any, { scopeRoot, repoRoot, fsImpl = fs }: any) {
-  const planned = harnessPlans.filter((target: any) => !target.skipped);
+function pruneRetiredRuntimeFiles(harnessPlans       , ledger     , { scopeRoot, repoRoot, fsImpl = fs }     ) {
+  const planned = harnessPlans.filter((target     ) => !target.skipped);
   if (!planned.length || !repoRoot) return harnessPlans;
-  const replaced = new Map<string, Map<any, any>>(planned.map((target: any) => [target.harness, new Map()]));
-  const added = new Map<string, any[]>(planned.map((target: any) => [target.harness, []]));
-  const notices = new Map<string, string[]>(planned.map((target: any) => [target.harness, []]));
-  const rows = (ledger?.resources ?? []).filter((row: any) => typeof row?.target === 'string');
-  const recorded = new Set(rows.map((row: any) => row.target));
-  const shown = (file: string) => path.relative(scopeRoot, file);
+  const replaced = new Map                       (planned.map((target     ) => [target.harness, new Map()]));
+  const added = new Map               (planned.map((target     ) => [target.harness, []]));
+  const notices = new Map                  (planned.map((target     ) => [target.harness, []]));
+  const rows = (ledger?.resources ?? []).filter((row     ) => typeof row?.target === 'string');
+  const recorded = new Set(rows.map((row     ) => row.target));
+  const shown = (file        ) => path.relative(scopeRoot, file);
 
   for (const assetId of RUNTIME_TREE_ASSETS) {
-    const executor = planned.find((target: any) => target.assets.some((asset: any) => asset.id === assetId));
+    const executor = planned.find((target     ) => target.assets.some((asset     ) => asset.id === assetId));
     if (!executor) continue;
-    const asset = executor.assets.find((item: any) => item.id === assetId);
+    const asset = executor.assets.find((item     ) => item.id === assetId);
     const nativeDir = typeof asset.nativeDir === 'string' ? asset.nativeDir : asset.nativeDir?.[executor.harness];
     const destDir = sharedTreeDestDir(scopeRoot, nativeDir);
     const sourceDir = path.resolve(repoRoot, asset.source);
     if (!destDir || !fsImpl.existsSync(sourceDir) || !fsImpl.existsSync(destDir)) continue;
-    const produced = discoverTree({ sourceDir, destDir, fsImpl }).files.map((file: any) => file.destAbs);
+    const produced = discoverTree({ sourceDir, destDir, fsImpl }).files.map((file     ) => file.destAbs);
     const producedSet = new Set(produced);
     const sameFile = sameFileIndex(produced, fsImpl);
     const realRoot = fsImpl.realpathSync(destDir);
 
-    const rowsAt = new Map<string, any[]>();
+    const rowsAt = new Map               ();
     for (const row of rows) {
       if (!isUnder(row.target, destDir) || producedSet.has(row.target)) continue;
       if (!rowsAt.has(row.target)) rowsAt.set(row.target, []);
-      rowsAt.get(row.target)!.push(row);
+      rowsAt.get(row.target) .push(row);
     }
-    const removalsAt = new Map<string, any[]>();
+    const removalsAt = new Map               ();
     for (const target of planned) {
       for (const change of target.changes) {
         if (change.operation !== 'remove' || change.assetId !== assetId || !isUnder(change.target, destDir) || producedSet.has(change.target)) continue;
         if (!removalsAt.has(change.target)) removalsAt.set(change.target, []);
-        removalsAt.get(change.target)!.push(change);
+        removalsAt.get(change.target) .push(change);
       }
     }
     /** Turn every planned removal of `file` into a release that deletes nothing. */
-    const keepFile = (file: string) => {
+    const keepFile = (file        ) => {
       for (const change of removalsAt.get(file) ?? []) {
-        if (!change.retained) replaced.get(change.harness)!.set(change, Object.freeze({ ...change, retained: true, retainedFor: [] }));
+        if (!change.retained) replaced.get(change.harness) .set(change, Object.freeze({ ...change, retained: true, retainedFor: [] }));
       }
     };
 
     for (const file of new Set([...rowsAt.keys(), ...removalsAt.keys()])) {
       const fileRows = rowsAt.get(file) ?? [];
       // Another asset's live row on this path is a claim this pass does not judge.
-      if (fileRows.some((row: any) => row.assetId !== assetId)) continue;
+      if (fileRows.some((row     ) => row.assetId !== assetId)) continue;
       const removals = removalsAt.get(file) ?? [];
       const identity = path.relative(destDir, file);
       // The rows no planned removal of this file releases on its own.
-      const superseded = fileRows.filter((row: any) => !removals.some((change: any) => change.harness === row.harness)).map((row: any) => ownershipKey(row));
-      const synthetic = (extra: any) => Object.freeze({
+      const superseded = fileRows.filter((row     ) => !removals.some((change     ) => change.harness === row.harness)).map((row     ) => ownershipKey(row));
+      const synthetic = (extra     ) => Object.freeze({
         harness: executor.harness, assetId, target: file, operation: 'remove', kind: 'copy-tree-file', identity,
         ownershipIdentity: `doflow:${executor.harness}:copy-tree:${assetId}:${identity}`, projection: { renderer: 'copy-tree' }, ...extra,
       });
 
       if (!fsImpl.existsSync(file)) {
         // Already gone (an interrupted run, a user's delete): the rows only point at nothing.
-        if (fileRows.length) added.get(executor.harness)!.push(synthetic({ fingerprint: null, retained: true, retainedFor: [], supersedes: superseded }));
+        if (fileRows.length) added.get(executor.harness) .push(synthetic({ fingerprint: null, retained: true, retainedFor: [], supersedes: superseded }));
         continue;
       }
       const real = fsImpl.realpathSync(file);
       if (!isUnder(real, realRoot)) {
         keepFile(file);
-        notices.get(executor.harness)!.push(`kept ${shown(file)}: no longer shipped, but it resolves outside ${shown(destDir)}`);
+        notices.get(executor.harness) .push(`kept ${shown(file)}: no longer shipped, but it resolves outside ${shown(destDir)}`);
         continue;
       }
       if (sameFile(file)) { keepFile(file); continue; }   // the produced file under an old spelling
       const current = sha256File(file, fsImpl);
-      if (!fileRows.some((row: any) => row.fingerprint === current)) {
+      if (!fileRows.some((row     ) => row.fingerprint === current)) {
         // A planned removal here was already kept by planTree, and its adapter named it.
-        if (!removals.length) notices.get(executor.harness)!.push(`kept ${shown(file)}: no longer shipped, changed since DoFlow wrote it`);
+        if (!removals.length) notices.get(executor.harness) .push(`kept ${shown(file)}: no longer shipped, changed since DoFlow wrote it`);
         continue;
       }
-      notices.get(executor.harness)!.push(`prune ${shown(file)}: no longer shipped, unchanged since DoFlow wrote it`);
+      notices.get(executor.harness) .push(`prune ${shown(file)}: no longer shipped, unchanged since DoFlow wrote it`);
       // removeTree re-runs containment and the same-file check from this right before the unlink.
       const pruneGuard = { root: destDir, source: sourceDir };
       if (!removals.length) {
-        added.get(executor.harness)!.push(synthetic({ fingerprint: current, supersedes: superseded, pruneGuard }));
+        added.get(executor.harness) .push(synthetic({ fingerprint: current, supersedes: superseded, pruneGuard }));
         continue;
       }
-      removals.forEach((change: any, index: number) => {
+      removals.forEach((change     , index        ) => {
         const { retained, retainedFor, ...rest } = change;
         void retained; void retainedFor;
-        replaced.get(change.harness)!.set(change, Object.freeze({ ...rest, fingerprint: current, pruneGuard, ...(index === 0 ? { supersedes: superseded } : {}) }));
+        replaced.get(change.harness) .set(change, Object.freeze({ ...rest, fingerprint: current, pruneGuard, ...(index === 0 ? { supersedes: superseded } : {}) }));
       });
     }
 
@@ -446,14 +447,26 @@ function pruneRetiredRuntimeFiles(harnessPlans: any[], ledger: any, { scopeRoot,
     for (const rel of walkRelFiles(destDir, fsImpl)) {
       const file = path.join(destDir, rel);
       if (producedSet.has(file) || recorded.has(file) || sameFile(file)) continue;
-      notices.get(executor.harness)!.push(`kept ${shown(file)}: not shipped by this version and not recorded as DoFlow's`);
+      notices.get(executor.harness) .push(`kept ${shown(file)}: not shipped by this version and not recorded as DoFlow's`);
     }
   }
-  return harnessPlans.map((target: any) => (target.skipped ? target
-    : withChanges(target, replaced.get(target.harness)!, added.get(target.harness)!, notices.get(target.harness)!)));
+  return harnessPlans.map((target     ) => (target.skipped ? target
+    : withChanges(target, replaced.get(target.harness) , added.get(target.harness) , notices.get(target.harness) )));
 }
 
-function planLifecycle({ registry, adapters, scope, scopeRoot, targets, mcpSelections = {}, mcpAdoptable = {}, retainedMcpIds = [], ledger, context = {} }: any) {
+/** One harness's plan entry, from what its adapter returned: the changes checked against the
+ * harness's assets, and the conflicts, prerequisites and notices in the lifecycle's common shape. */
+function targetFromResult({ harness, assets, mcp, mcpSelected, policies, adapterInput, discovery, result }     ) {
+  if (!result || typeof result !== 'object') throw new Error(`Adapter '${harness.id}' returned an invalid plan`);
+  const changes = (result.changes || []).map((change     ) => normalizeChange(change, { harness, assets }));
+  const conflicts = adapterConflicts(result, harness);
+  const prerequisites = [...(result.prerequisites || []), ...changes.map((change     ) => change.prerequisite).filter(Boolean)];
+  const requiredNativeResources = result.requiredNativeResources ?? changes;
+  if (!Array.isArray(requiredNativeResources)) throw new Error(`Adapter '${harness.id}' returned invalid requiredNativeResources`);
+  return { harness: harness.id, adapter: harness.adapter, assets, mcp, mcpSelected, policies, adapterInput, discovery, changes, requiredNativeResources, conflicts, prerequisites, notices: adapterNotices(result), skipped: false };
+}
+
+function planLifecycle({ registry, adapters, scope, scopeRoot, targets, mcpSelections = {}, mcpAdoptable = {}, retainedMcpIds = [], ledger, context = {} }     ) {
   assertScope(scope);
   if (!registry) throw new Error('registry is required');
   const baseLedger = ledger ?? defaultLedger({ scope, scopeRoot });
@@ -467,7 +480,7 @@ function planLifecycle({ registry, adapters, scope, scopeRoot, targets, mcpSelec
     const policies = renderPolicies(registry, { harness: harness.id });
     const adoptable = capable ? selectMcpServers(registry, catalogIds(registry, mcpAdoptable[harness.id] ?? [])) : [];
     const adapter = resolveAdapter(adapters, harness);
-    const project = (mcp: any) => projectAdapterInput({ registry, harness, scope, scopeRoot, assets, mcp, mcpAdoptable: adoptable, policies, context });
+    const project = (mcp     ) => projectAdapterInput({ registry, harness, scope, scopeRoot, assets, mcp, mcpAdoptable: adoptable, policies, context });
     // `keep` asks the adapter what it owns before the real projection: the probe carries no
     // selection, so discovery reads the files as they are.
     const ids = selection === MCP_KEEP
@@ -478,13 +491,7 @@ function planLifecycle({ registry, adapters, scope, scopeRoot, targets, mcpSelec
     const input = { ...adapterInput, registry, ledger: baseLedger };
     const discovery = adapter.discover(input);
     const result = adapter.plan({ ...input, discovery });
-    if (!result || typeof result !== 'object') throw new Error(`Adapter '${harness.id}' returned an invalid plan`);
-    const changes = (result.changes || []).map((change: any) => normalizeChange(change, { harness, assets }));
-    const conflicts = adapterConflicts(result, harness);
-    const prerequisites = [...(result.prerequisites || []), ...changes.map((change: any) => change.prerequisite).filter(Boolean)];
-    const requiredNativeResources = result.requiredNativeResources ?? changes;
-    if (!Array.isArray(requiredNativeResources)) throw new Error(`Adapter '${harness.id}' returned invalid requiredNativeResources`);
-    return { harness: harness.id, adapter: harness.adapter, assets, mcp, mcpSelected: capable ? mcp.map((server: any) => server.id) : null, policies, adapterInput, discovery, changes, requiredNativeResources, conflicts, prerequisites, notices: adapterNotices(result), skipped: false };
+    return targetFromResult({ harness, assets, mcp, mcpSelected: capable ? mcp.map((server     ) => server.id) : null, policies, adapterInput, discovery, result });
   });
   // The MCP index names every server a harness of this scope uses: the selections planned here and
   // the recorded selections of the harnesses this run does not touch.
@@ -495,18 +502,23 @@ function planLifecycle({ registry, adapters, scope, scopeRoot, targets, mcpSelec
   const retained = markRetainedRemovals(harnessPlans, baseLedger, scope);
   const annotated = context.operation === 'remove' ? retained
     : pruneRetiredRuntimeFiles(retained, baseLedger, { scopeRoot, repoRoot: context.repoRoot });
-  const changes = annotated.flatMap((item: any) => item.changes);
-  const conflicts = annotated.flatMap((item: any) => item.conflicts.map((reason: any) => ({ harness: item.harness, reason })));
-  const prerequisites = annotated.flatMap((item: any) => item.prerequisites.map((prerequisite: any) => ({ harness: item.harness, prerequisite })));
-  const requiredNativeResources = annotated.flatMap((item: any) => item.requiredNativeResources || []);
-  const notices = annotated.flatMap((item: any) => item.notices.map((notice: any) => ({ harness: item.harness, notice })));
-  return Object.freeze({ scope, scopeRoot, mcp: selectedMcp, ledger: baseLedger, targets: annotated, changes, requiredNativeResources, conflicts, prerequisites, notices,
+  // The shared hooks tree may have moved under harnesses this run does not name (IC-037): their
+  // front doors come along, as targets of this same plan.
+  const companions = planHookCompanions({ registry, adapters, scope, harnessScope: registryScope(scope), scopeRoot, ledger: baseLedger, context,
+    targets: annotated, targetFromResult });
+  const planned = [...annotated, ...companions];
+  const changes = planned.flatMap((item     ) => item.changes);
+  const conflicts = planned.flatMap((item     ) => item.conflicts.map((reason     ) => ({ harness: item.harness, reason })));
+  const prerequisites = planned.flatMap((item     ) => item.prerequisites.map((prerequisite     ) => ({ harness: item.harness, prerequisite })));
+  const requiredNativeResources = planned.flatMap((item     ) => item.requiredNativeResources || []);
+  const notices = planned.flatMap((item     ) => item.notices.map((notice     ) => ({ harness: item.harness, notice })));
+  return Object.freeze({ scope, scopeRoot, mcp: selectedMcp, ledger: baseLedger, targets: planned, changes, requiredNativeResources, conflicts, prerequisites, notices,
     retained: retainedChanges(changes), safe: conflicts.length === 0 && prerequisites.length === 0 });
 }
 
-function verificationResources(verification: any, changes: any, scope: any, recoveryRef: any) {
-  if (verification.resources.length) return verification.resources.map((resource: any) => ({ ...resource, harness: verification.harness, scope, recoveryRef: resource.recoveryRef ?? recoveryRef }));
-  return changes.filter((change: any) => change.operation !== 'remove').map((change: any) => ({
+function verificationResources(verification     , changes     , scope     , recoveryRef     ) {
+  if (verification.resources.length) return verification.resources.map((resource     ) => ({ ...resource, harness: verification.harness, scope, recoveryRef: resource.recoveryRef ?? recoveryRef }));
+  return changes.filter((change     ) => change.operation !== 'remove').map((change     ) => ({
     harness: change.harness, scope, assetId: change.assetId, target: change.target,
     ownershipIdentity: change.ownershipIdentity, fingerprint: change.afterFingerprint ?? null,
     sourceVersion: change.sourceVersion ?? 'unknown', projection: change.projection ?? null, recoveryRef,
@@ -516,7 +528,7 @@ function verificationResources(verification: any, changes: any, scope: any, reco
 /** The guidance-content layer's own version marker (core/shared/guidance/VERSION, copy-treed
  * to <scopeRoot>/.doflow/guidance/VERSION) is independent of this package's version — read it
  * fresh on every ledger update so the ledger reflects whatever is actually on disk. */
-function readGuidanceVersion(scopeRoot: any, fsImpl = fs) {
+function readGuidanceVersion(scopeRoot     , fsImpl = fs) {
   const file = path.join(scopeRoot, '.doflow', 'guidance', 'VERSION');
   if (!fsImpl.existsSync(file)) return null;
   return fsImpl.readFileSync(file, 'utf8').trim();
@@ -532,7 +544,7 @@ function readGuidanceVersion(scopeRoot: any, fsImpl = fs) {
  * same anchor DOFLOW_CORE.md's own @-imports use. Writing this file into a subdirectory would
  * silently reinterpret every one of those paths against that subdirectory and break them all,
  * with no error at install time. test/mcp-index.test.js pins the anchor from both ends. */
-function mcpIndexPath(scopeRoot: any) {
+function mcpIndexPath(scopeRoot     ) {
   return path.join(scopeRoot, '.doflow', 'guidance', 'MCP_INDEX.md');
 }
 
@@ -547,7 +559,7 @@ function mcpIndexPath(scopeRoot: any) {
  * shared runtime, in the one asset that is generated rather than ledger-tracked and so cannot be
  * protected by ownership counting. The remaining harnesses' MCP selection has not changed, so the
  * file is left exactly as it is rather than re-rendered from this removal's empty selection. */
-function applyMcpIndex({ scopeRoot, selectedMcp, mode, retain = false, fsImpl = fs }: any) {
+function applyMcpIndex({ scopeRoot, selectedMcp, mode, retain = false, fsImpl = fs }     ) {
   const file = mcpIndexPath(scopeRoot);
   const content = mode === 'remove' ? null : renderMcpIndex(selectedMcp);
   if (content === null) {
@@ -559,7 +571,7 @@ function applyMcpIndex({ scopeRoot, selectedMcp, mode, retain = false, fsImpl =
   fsImpl.writeFileSync(file, content);
 }
 
-function updateLedger({ ledger, scope, scopeRoot, verifications, changes, recoveryRef, fsImpl = fs }: any) {
+function updateLedger({ ledger, scope, scopeRoot, verifications, changes, recoveryRef, fsImpl = fs }     ) {
   // upgradeLedger makes every written ledger v2-shaped (tombstone log present) while v1 inputs
   // stay readable — migration happens on write, never as a separate user-facing step.
   const next = JSON.parse(JSON.stringify(upgradeLedger(ledger ?? defaultLedger({ scope, scopeRoot }))));
@@ -571,13 +583,13 @@ function updateLedger({ ledger, scope, scopeRoot, verifications, changes, recove
     priorByIdentity.set(`${resource.harness}\u0000${resource.assetId}\u0000${resource.identity ?? ''}`, resource);
   }
   for (const verification of verifications) {
-    const related = changes.filter((change: any) => change.harness === verification.harness);
-    const removed = related.filter((change: any) => change.operation === 'remove');
-    const removeKeys = new Set(removed.map((change: any) => ownershipKey({ harness: change.harness, scope, assetId: change.assetId, target: change.target, ownershipIdentity: change.ownershipIdentity })));
+    const related = changes.filter((change     ) => change.harness === verification.harness);
+    const removed = related.filter((change     ) => change.operation === 'remove');
+    const removeKeys = new Set(removed.map((change     ) => ownershipKey({ harness: change.harness, scope, assetId: change.assetId, target: change.target, ownershipIdentity: change.ownershipIdentity })));
     // A runtime prune also gives up the rows other harnesses hold on the file it deletes
     // (pruneRetiredRuntimeFiles): released here, in the same write, so no row outlives its file.
     for (const change of removed) for (const key of change.supersedes ?? []) removeKeys.add(key);
-    next.resources = next.resources.filter((resource: any) => !removeKeys.has(ownershipKey(resource)));
+    next.resources = next.resources.filter((resource     ) => !removeKeys.has(ownershipKey(resource)));
     for (const resource of verificationResources(verification, related, scope, recoveryRef)) {
       const key = ownershipKey(resource);
       // A verifier enumerates what is on disk, and a released-but-retained file is deliberately
@@ -590,9 +602,9 @@ function updateLedger({ ledger, scope, scopeRoot, verifications, changes, recove
       const prior = priorByIdentity.get(`${resource.harness}\u0000${resource.assetId}\u0000${resource.identity ?? ''}`);
       if (prior && prior.target !== resource.target) {
         const supersededKey = ownershipKey(prior);
-        next.resources = next.resources.filter((item: any) => ownershipKey(item) !== supersededKey);
+        next.resources = next.resources.filter((item     ) => ownershipKey(item) !== supersededKey);
       }
-      const index = next.resources.findIndex((item: any) => ownershipKey(item) === key);
+      const index = next.resources.findIndex((item     ) => ownershipKey(item) === key);
       if (index >= 0) next.resources[index] = resource;
       else next.resources.push(resource);
     }
@@ -605,7 +617,7 @@ function updateLedger({ ledger, scope, scopeRoot, verifications, changes, recove
   for (const resource of next.resources) {
     const prior = priorByIdentity.get(`${resource.harness}\u0000${resource.assetId}\u0000${resource.identity ?? ''}`);
     if (!prior || prior.target === resource.target) continue;
-    if (!next.tombstones.some((entry: any) => entry.harness === resource.harness
+    if (!next.tombstones.some((entry     ) => entry.harness === resource.harness
       && entry.fromTarget === prior.target && entry.toTarget === resource.target)) {
       next.tombstones.push({
         harness: resource.harness, assetId: resource.assetId,
@@ -614,7 +626,7 @@ function updateLedger({ ledger, scope, scopeRoot, verifications, changes, recove
       });
     }
   }
-  const claims = new Set(next.resources.map((resource: any) => resource.target));
+  const claims = new Set(next.resources.map((resource     ) => resource.target));
   for (const entry of next.tombstones) {
     if (entry.sweptAt || !fsImpl.existsSync(entry.fromTarget) || claims.has(entry.fromTarget)) continue;
     try {
@@ -632,7 +644,7 @@ function updateLedger({ ledger, scope, scopeRoot, verifications, changes, recove
   return next;
 }
 
-function verifyLifecycle({ plan, adapters, context = {} }: any) {
+function verifyLifecycle({ plan, adapters, context = {} }     ) {
   const verifications = [];
   for (const target of plan.targets) {
     if (target.skipped) continue;
@@ -642,19 +654,21 @@ function verifyLifecycle({ plan, adapters, context = {} }: any) {
     // After an apply, the files this harness just wrote: a copy-tree verifier reports one that is
     // missing instead of skipping it like a file the user deleted.
     const plannedWrites = context.checkPlannedWrites
-      ? target.changes.filter((change: any) => !change.retained && (change.operation === 'create' || change.operation === 'update')).map((change: any) => change.target)
+      ? target.changes.filter((change     ) => !change.retained && (change.operation === 'create' || change.operation === 'update')).map((change     ) => change.target)
       : undefined;
-    let verification = normalizeVerification(adapter.verify({ ...target.adapterInput,
+    // A hook-front-door companion (IC-037) is verified for its doors alone: the rest of that
+    // harness is not part of this run and may legitimately trail the current source.
+    let verification = normalizeVerification(adapter[target.hookDoorsOnly ? 'verifyHookDoors' : 'verify']({ ...target.adapterInput,
       registry: context.registry ?? plan.registry, discovery: target.discovery, ledger: plan.ledger,
       operation, context: { ...target.adapterInput.context, operation, ...(plannedWrites ? { plannedWrites } : {}) } }), harness);
     if (operation === 'remove') verification = normalizeRemovalVerification(verification, target.changes, plan.ledger);
     verifications.push({ ...verification, hookWiring: hookWiringStatus(harness, target, verification) });
   }
-  const conflicts = verifications.flatMap((result) => (result.conflicts || []).map((reason: any) => ({ harness: result.harness, reason })));
+  const conflicts = verifications.flatMap((result) => (result.conflicts || []).map((reason     ) => ({ harness: result.harness, reason })));
   return { verifications, conflicts, ok: conflicts.length === 0 && verifications.every((result) => result.ok !== false) };
 }
 
-function assertPlanApplicable(plan: any, stateRoot: any, acceptPrerequisites: any) {
+function assertPlanApplicable(plan     , stateRoot     , acceptPrerequisites     ) {
   if (!plan.safe && !(acceptPrerequisites && plan.conflicts.length === 0)) throw new Error('Refusing to apply an unsafe lifecycle plan');
   if (!stateRoot) throw new Error('stateRoot is required before lifecycle mutation');
   if (!plan.requiredNativeResources?.length || !plan.changes.length) throw new Error('Refusing to apply a lifecycle plan with no required native resources');
@@ -664,35 +678,35 @@ function assertPlanApplicable(plan: any, stateRoot: any, acceptPrerequisites: an
  * plan selected — currently only claude.hooks-scripts and kiro.hooks-scripts. Codex and Gemini
  * deploy hooks via their own bespoke code paths (see targetNeedsHooks below) rather than a
  * registered asset, so they never appear here. */
-function hookAssetIds(target: any) {
-  return new Set((target.assets || []).filter((asset: any) => asset.kind === 'hooks').map((asset: any) => asset.id));
+function hookAssetIds(target     ) {
+  return new Set((target.assets || []).filter((asset     ) => asset.kind === 'hooks').map((asset     ) => asset.id));
 }
 
 /** Whether this harness's plan includes at least one hooks-bearing change. Claude's hooks are a
  * registry-declared asset (`kind: "hooks"` in core/registry/assets.json); Codex and Gemini deploy
  * hooks via their own bespoke code paths and tag the resulting change with `nativeComponent:
- * 'hooks'` instead (see src/adapters/codex/index.ts and src/adapters/gemini/index.ts). Either
+ * 'hooks'` instead (see src/adapters/codex/index.js and src/adapters/gemini/index.js). Either
  * signal is sufficient — this stays harness-agnostic on purpose. */
-function targetNeedsHooks(target: any) {
+function targetNeedsHooks(target     ) {
   const hookIds = hookAssetIds(target);
-  return (target.changes || []).some((change: any) => hookIds.has(change.assetId) || change.nativeComponent === 'hooks');
+  return (target.changes || []).some((change     ) => hookIds.has(change.assetId) || change.nativeComponent === 'hooks');
 }
 
 /** Whether a verified resource is the hooks resource this harness owns. A registry-declared hooks
  * asset (Claude, Kiro) is matched by assetId; Codex's bespoke hooks-file resource is matched by
  * `kind`; Gemini's bespoke hooks resource (a key inside settings.json, not a standalone file) is
- * matched by its `projection.renderer` tag — see src/adapters/codex/index.ts's
- * `lifecycleResource(..., kind: 'hooks-file', ...)` and src/adapters/gemini/index.ts's verify(),
+ * matched by its `projection.renderer` tag — see src/adapters/codex/index.js's
+ * `lifecycleResource(..., kind: 'hooks-file', ...)` and src/adapters/gemini/index.js's verify(),
  * which tags its hooks resource `projection: { renderer: 'gemini-hooks' }`. */
-function verificationOwnsHooks(verification: any, hookIds: any) {
-  return (verification?.resources || []).some((resource: any) =>
+function verificationOwnsHooks(verification     , hookIds     ) {
+  return (verification?.resources || []).some((resource     ) =>
     hookIds.has(resource.assetId) || resource.kind === 'hooks-file' || resource.projection?.renderer === 'gemini-hooks');
 }
 
 /** Gemini's hooks trust, observed through the adapter's own API. How trust is computed — the
  * fingerprint semantics, which context fields matter — lives in src/adapters/gemini (review A3:
  * this file used to import planGeminiHooks and re-derive the plan itself). */
-function geminiHookTrust(target: any) {
+function geminiHookTrust(target     ) {
   return geminiHookTrustFor(target);
 }
 
@@ -706,7 +720,7 @@ function geminiHookTrust(target: any) {
  *    trust computation via geminiHookTrust above.
  *  - 'active': installed with no unmet prerequisite (Claude and Kiro today, since neither declares
  *    any `capabilities.hooks.prerequisites` and Kiro hooks activate automatically per kiro.dev). */
-function hookWiringStatus(harness: any, target: any, verification: any) {
+function hookWiringStatus(harness     , target     , verification     ) {
   if (!target || target.skipped) return { status: 'absent', prerequisites: [] };
   if (!verificationOwnsHooks(verification, hookAssetIds(target))) return { status: 'absent', prerequisites: [] };
   if (harness.id === 'gemini') {
@@ -725,15 +739,15 @@ function hookWiringStatus(harness: any, target: any, verification: any) {
  * silently at runtime. Only harnesses whose selected changes actually include hooks trigger
  * this — a plan touching only guidance/skills assets never invokes the check. Removal is
  * exempt: deleting hook files does not require running them. */
-function assertBashAvailableForHooks(plan: any, mode: any, hasBashCapableShellFn: any) {
+function assertBashAvailableForHooks(plan     , mode     , hasBashCapableShellFn     ) {
   if (mode === 'remove') return;
-  const hookHarnesses = plan.targets.filter((target: any) => !target.skipped && targetNeedsHooks(target)).map((target: any) => target.harness);
+  const hookHarnesses = plan.targets.filter((target     ) => !target.skipped && targetNeedsHooks(target)).map((target     ) => target.harness);
   if (hookHarnesses.length === 0) return;
   if (hasBashCapableShellFn()) return;
   throw new Error(`No bash-capable shell detected (checked: bash --version). Install Git Bash for Windows, or run inside WSL, before installing hooks for ${hookHarnesses.join(', ')}.`);
 }
 
-function applyLifecycle({ plan, registry, adapters, stateRoot, ledger = plan.ledger, context = {}, mode = 'apply', acceptPrerequisites = false, writeLedgerFn = writeLedger, writeRecoveryRecordFn = writeRecoveryRecord, hasBashCapableShellFn = hasBashCapableShell }: any) {
+function applyLifecycle({ plan, registry, adapters, stateRoot, ledger = plan.ledger, context = {}, mode = 'apply', acceptPrerequisites = false, writeLedgerFn = writeLedger, writeRecoveryRecordFn = writeRecoveryRecord, hasBashCapableShellFn = hasBashCapableShell }     ) {
   assertPlanApplicable(plan, stateRoot, acceptPrerequisites);
   assertBashAvailableForHooks(plan, mode, hasBashCapableShellFn);
   const recovery = writeRecoveryRecordFn(stateRoot, { status: 'pending', changes: plan.changes });
@@ -745,14 +759,14 @@ function applyLifecycle({ plan, registry, adapters, stateRoot, ledger = plan.led
       // it, because every adapter's job with a removal change is to delete the thing. Filtered
       // here rather than in planLifecycle so the change still reaches updateLedger, which is what
       // actually drops this harness's ownership row.
-      const applicable = target.changes.filter((change: any) => !change.retained);
+      const applicable = target.changes.filter((change     ) => !change.retained);
       if (!applicable.length) continue;
       const harness = harnessFor(registry, target.harness);
       const adapter = resolveAdapter(adapters, harness);
       adapter[mode === 'remove' ? 'remove' : 'apply']({ ...target.adapterInput, registry, changes: applicable, ledger, recoveryRef: recovery.id });
       completedHarnesses.push(target.harness);
     }
-  } catch (error: any) {
+  } catch (error     ) {
     // A mid-loop throw (fs error, TOCTOU ownership mismatch) leaves some harnesses' native writes
     // already on disk. Recording exactly which ones completed — rather than leaving the record
     // stuck at 'pending' forever — is the difference between a diagnosable partial failure and a
@@ -768,7 +782,7 @@ function applyLifecycle({ plan, registry, adapters, stateRoot, ledger = plan.led
   }
   try {
     applyMcpIndex({ scopeRoot: plan.scopeRoot, selectedMcp: plan.mcp, mode, retain: !removalIsTotal(plan) });
-  } catch (error: any) {
+  } catch (error     ) {
     // Same reasoning as the harness-loop catch above: every native resource already applied and
     // verified successfully by this point, so leaving the record at 'pending' on a failure here
     // would hide that success and make a retry indistinguishable from a from-scratch install.
@@ -789,14 +803,14 @@ function applyLifecycle({ plan, registry, adapters, stateRoot, ledger = plan.led
  * selects. Verify only reads; this writes the ledger and nothing native. `dryRun` reports without
  * writing. Returns the ledger and the server ids recorded per harness.
  */
-function recordMcpOwnership({ plan, registry, adapters, stateRoot, ledger = plan.ledger, dryRun = false, writeLedgerFn = writeLedger }: any) {
+function recordMcpOwnership({ plan, registry, adapters, stateRoot, ledger = plan.ledger, dryRun = false, writeLedgerFn = writeLedger }     ) {
   const { verifications } = verifyLifecycle({ plan: { ...plan, registry }, adapters, context: { registry, operation: 'apply' } });
-  const held = new Set((ledger.resources || []).map((resource: any) => ownershipKey(resource)));
+  const held = new Set((ledger.resources || []).map((resource     ) => ownershipKey(resource)));
   const added = verifications.flatMap((verification) => (verification.resources || [])
-    .filter((resource: any) => resource.kind === 'mcp-server')
-    .map((resource: any) => ({ ...resource, harness: verification.harness, scope: plan.scope, recoveryRef: resource.recoveryRef ?? null })))
+    .filter((resource     ) => resource.kind === 'mcp-server')
+    .map((resource     ) => ({ ...resource, harness: verification.harness, scope: plan.scope, recoveryRef: resource.recoveryRef ?? null })))
     .filter((resource) => !held.has(ownershipKey(resource)));
-  const recorded: Record<string, any[]> = {};
+  const recorded                        = {};
   for (const resource of added) (recorded[resource.harness] ??= []).push(resource.identity);
   if (!added.length || dryRun) return { ledger, recorded };
   const next = upgradeLedger({ ...ledger, resources: [...(ledger.resources || []), ...added] });
@@ -804,7 +818,7 @@ function recordMcpOwnership({ plan, registry, adapters, stateRoot, ledger = plan
   return { ledger: next, recorded };
 }
 
-function removeLifecycle(options: any) {
+function removeLifecycle(options     ) {
   const plan = planLifecycle({ ...options, context: { ...(options.context || {}), operation: 'remove' } });
   return applyLifecycle({ ...options, plan, mode: 'remove', acceptPrerequisites: options.acceptPrerequisites });
 }