@foggy-projects/deepseek-harness-plugin 0.4.0-beta.4 → 0.4.0-beta.6

package/README.md

@@ -8,7 +8,7 @@ only when the user selects **Initialize Foggy**.
 ## Local beta installation
 
 ```powershell
-dsh plugin --profile web add --workspace-root ./foggy-projects-deepseek-harness-plugin-0.4.0-beta.4.tgz
+dsh plugin --profile web add --workspace-root ./foggy-projects-deepseek-harness-plugin-0.4.0-beta.6.tgz
 ```
 
 Restart `dsh web`, open Settings → Plugins → Foggy Data Analysis, and initialize
@@ -20,27 +20,32 @@ After npm beta publication, the corresponding one-line install is:
 dsh plugin --profile web add --workspace-root @foggy-projects/deepseek-harness-plugin@beta
 ```
 
-For development, `FOGGY_PROJECT_ROOT` can override the workspace that receives
-the Skills and `FOGGY_ASSET_CACHE_DIRS` can contain platform-delimited verified
-asset-cache directories. Neither variable is required for a normal install.
+For development, `FOGGY_ASSET_CACHE_DIRS` can contain platform-delimited verified
+asset-cache directories. It is not required for a normal install.
 
-Database credentials are deliberately outside the ordinary DSH settings
-document. The database and semantic-layer wizard is the next Bundle milestone.
+Database credentials remain outside the ordinary DSH settings document. The
+bundled onboarding Skill drives datasource discovery, semantic drafting,
+checkpointed publication, and bounded read-only query verification.
 
-## Managed workspace contract
+## Native Skill and workspace contract
 
-Initialization writes a non-secret discovery document at
-`.foggy/deepseek-harness/context.json` in the selected project. It points agents
-to the authoritative global install state, the managed CLI's absolute command,
-the Runtime state, and the two workspace Skills. The managed CLI is intentionally
-isolated and does not need to be on `PATH`.
+The Bundle registers `foggy-deepseek-onboarding` and the downloaded
+`foggy-ai-analysis` through DeepSeek Harness's native Skill provider API. Skills
+are available in every DSH workspace without copying or symlinking `.agents`.
+The current session `cwd` remains the workspace boundary for semantic drafts and
+evidence.
 
-Both `foggy-deepseek-onboarding` and `foggy-ai-analysis` carry a
-`.foggy-managed-skill.json` marker. **Re-download / Repair** verifies their
-managed content, backs up a modified or outdated Skill under
-`.foggy/onboarding-backups`, restores missing content, and regenerates the
-project context. If a Skill is restored while Harness is already running, start
-a new task or restart Harness so its Skill registry can reload it.
+Opaque CLI profiles default to the private persistent
+`<dataRoot>/cli-profiles` directory. Composite onboarding commands are
+idempotent: unchanged completed phases are resumed rather than re-adding a
+datasource or re-registering a published bundle.
+
+CLI, Launcher, the analysis Skill, install state, and Runtime state live in the
+user-level Foggy component directories. The managed CLI is intentionally isolated
+and does not need to be on `PATH`. **Re-download / Repair** verifies the global
+analysis Skill, backs up modified or outdated managed content, restores it, and
+invalidates DSH's Skill catalog. The onboarding Skill is bundled with the plugin
+and is restored by reinstalling or upgrading the plugin package.
 
 ## Linux and WSL2 experience
 

package/lib/client.js

@@ -42,7 +42,7 @@ window.__ModuleLoader__.load({
       launcher: 'Launcher',
       analysisSkill: '分析 Skill',
       onboardingSkill: '引导 Skill',
-      projectContext: '项目安装上下文',
+      skillRegistry: 'DSH Skill 注册',
       python: 'Python',
       java: 'Java',
       installed: '已安装',
@@ -59,7 +59,7 @@ window.__ModuleLoader__.load({
       progressCli: '准备 CLI',
       progressLauncher: '准备 Launcher',
       progressAnalysis: '准备分析 Skill',
-      progressSkills: '安装工作区 Skills',
+      progressSkills: '注册 DSH Skills',
       progressState: '写入安装状态',
       progressComplete: '初始化完成',
       progressFiles: '文件',
@@ -68,11 +68,10 @@ window.__ModuleLoader__.load({
       roots: '本地目录',
       installRoot: '组件目录',
       dataRoot: '数据目录',
+      profileStore: 'CLI Profile',
       runtimeUrl: 'Runtime 地址',
-      projectRoot: 'Skill 目标工作区',
-      contextPath: '对话发现文件',
       nextTitle: '后续配置',
-      nextCopy: '对话会从项目内固定的 context.json 读取 CLI、Runtime 与 Skill 安装状态，不再依赖 PATH 猜测。Runtime 启动成功后，将继续进入数据库连接与语义层向导。',
+      nextCopy: 'Skills 已通过 DeepSeek Harness 原生注册表提供给所有工作区；每个会话直接使用自己的工作目录。Runtime 启动成功后，将继续进入数据库连接与语义层向导。',
       beta: 'Beta',
     }
 
@@ -92,7 +91,7 @@ window.__ModuleLoader__.load({
       launcher: 'Launcher',
       analysisSkill: 'Analysis Skill',
       onboardingSkill: 'Onboarding Skill',
-      projectContext: 'Project install context',
+      skillRegistry: 'DSH Skill registry',
       python: 'Python',
       java: 'Java',
       installed: 'Installed',
@@ -109,7 +108,7 @@ window.__ModuleLoader__.load({
       progressCli: 'Preparing CLI',
       progressLauncher: 'Preparing Launcher',
       progressAnalysis: 'Preparing analysis Skill',
-      progressSkills: 'Installing workspace Skills',
+      progressSkills: 'Registering DSH Skills',
       progressState: 'Writing install state',
       progressComplete: 'Initialization complete',
       progressFiles: 'files',
@@ -118,11 +117,10 @@ window.__ModuleLoader__.load({
       roots: 'Local directories',
       installRoot: 'Components',
       dataRoot: 'Data',
+      profileStore: 'CLI profiles',
       runtimeUrl: 'Runtime URL',
-      projectRoot: 'Skill target workspace',
-      contextPath: 'Conversation discovery file',
       nextTitle: 'Next configuration',
-      nextCopy: 'Conversations discover the installed CLI, Runtime, and Skills from the fixed project context.json instead of guessing from PATH. After Runtime starts, the database connection and semantic-layer wizard comes next.',
+      nextCopy: 'Skills are provided to every workspace through the native DeepSeek Harness registry, and each session uses its own working directory. After Runtime starts, the database connection and semantic-layer wizard comes next.',
       beta: 'Beta',
     }
 
@@ -285,15 +283,14 @@ window.__ModuleLoader__.load({
           componentCard(t('launcher'), status.components.launcher, 'runtime', t),
           componentCard(t('analysisSkill'), status.components.analysisSkill, 'runtime', t),
           componentCard(t('onboardingSkill'), status.components.onboardingSkill, 'runtime', t),
-          componentCard(t('projectContext'), status.components.projectContext, 'runtime', t),
+          componentCard(t('skillRegistry'), { installed: status.components.onboardingSkill?.provider === 'foggy-managed-skills', version: 'native' }, 'runtime', t),
         ] }),
         jsxs('div', { className: 'foggy-paths', children: [
           jsx('h4', { children: t('roots') }),
           jsxs('dl', { children: [
             jsx('dt', { children: t('installRoot') }), jsx('dd', { children: status.roots.installRoot }),
             jsx('dt', { children: t('dataRoot') }), jsx('dd', { children: status.roots.dataRoot }),
-            jsx('dt', { children: t('projectRoot') }), jsx('dd', { children: status.projectRoot }),
-            jsx('dt', { children: t('contextPath') }), jsx('dd', { children: status.contextPath }),
+            jsx('dt', { children: t('profileStore') }), jsx('dd', { children: status.roots.profileStore }),
             status.runtimeUrl ? jsx('dt', { children: t('runtimeUrl') }) : null,
             status.runtimeUrl ? jsx('dd', { children: status.runtimeUrl }) : null,
           ] }),

package/lib/index.js

@@ -5,6 +5,7 @@ import { dirname, join, delimiter } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { promisify } from 'node:util'
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol'
+import { createFoggySkillProvider } from './skill-provider.js'
 import { compatible } from './version.js'
 
 const execFileAsync = promisify(execFile)
@@ -19,17 +20,20 @@ function defaultRoots() {
     return {
       installRoot: join(base, 'Foggy', 'DeepSeekHarness'),
       dataRoot: join(base, 'Foggy', 'DeepSeekHarnessData'),
+      profileStore: process.env.FOGGY_RUNTIME_PROFILE_STORE || join(base, 'Foggy', 'DeepSeekHarnessData', 'cli-profiles'),
     }
   }
   const home = process.env.HOME
   if (!home) throw new Error('HOME is not set')
+  const dataRoot = process.env.XDG_STATE_HOME
+    ? join(process.env.XDG_STATE_HOME, 'foggy', 'deepseek-harness')
+    : join(home, '.local', 'state', 'foggy', 'deepseek-harness')
   return {
     installRoot: process.env.XDG_DATA_HOME
       ? join(process.env.XDG_DATA_HOME, 'foggy', 'deepseek-harness')
       : join(home, '.local', 'share', 'foggy', 'deepseek-harness'),
-    dataRoot: process.env.XDG_STATE_HOME
-      ? join(process.env.XDG_STATE_HOME, 'foggy', 'deepseek-harness')
-      : join(home, '.local', 'state', 'foggy', 'deepseek-harness'),
+    dataRoot,
+    profileStore: process.env.FOGGY_RUNTIME_PROFILE_STORE || join(dataRoot, 'cli-profiles'),
   }
 }
 
@@ -120,20 +124,26 @@ function operationView(operation) {
 }
 
 export class FoggyIntegrationGateway extends TypertRemoteService {
+  static inject = ['skills']
+
   operation = null
+  skillProviderControl = null
 
   constructor(ctx) {
     super(ctx, 'foggyIntegration')
+    const roots = defaultRoots()
+    ctx.skills.registerProvider((control) => {
+      this.skillProviderControl = control
+      return createFoggySkillProvider({ installRoot: roots.installRoot, versionsFile })
+    })
     for (const initialize of markerInitializers) initialize.call(this)
   }
 
   async status() {
     const roots = defaultRoots()
-    const projectRoot = process.env.FOGGY_PROJECT_ROOT || process.cwd()
     const statePath = join(roots.installRoot, 'install-state.json')
     const runtimeStatePath = join(roots.dataRoot, 'runtime-state.json')
     const progressPath = join(roots.dataRoot, 'operation-progress.json')
-    const contextPath = join(projectRoot, '.foggy', 'deepseek-harness', 'context.json')
     const manifest = await readJson(versionsFile)
     let pythonProbe
     try {
@@ -145,16 +155,13 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
     const java = compatible(await commandVersion(process.env.JAVA_EXE || 'java', ['-version']), '17.0')
     let state = null
     let runtime = null
-    let context = null
     try { state = await readJson(statePath) } catch {}
     try { runtime = await readJson(runtimeStatePath) } catch {}
-    try { context = await readJson(contextPath) } catch {}
     const cliPath = state?.cli?.command
     const launcherPath = state?.launcher?.path
-    const analysisSkillPath = state?.skills?.analysis?.path || join(projectRoot, '.agents', 'skills', 'foggy-ai-analysis')
-    const onboardingSkillPath = state?.skills?.onboarding?.path || join(projectRoot, '.agents', 'skills', 'foggy-deepseek-onboarding')
+    const analysisSkillPath = state?.skills?.analysis?.path || join(roots.installRoot, 'skills', 'foggy-ai-analysis')
+    const onboardingSkillPath = join(packageRoot, 'skills', 'foggy-deepseek-onboarding')
     const analysisMarker = await readOptionalJson(join(analysisSkillPath, '.foggy-managed-skill.json'))
-    const onboardingMarker = await readOptionalJson(join(onboardingSkillPath, '.foggy-managed-skill.json'))
     const components = {
       python,
       java,
@@ -175,28 +182,15 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
         version: state?.skills?.analysis?.version ?? manifest.components.analysisSkill.version,
       },
       onboardingSkill: {
-        installed: Boolean(
-          await exists(join(onboardingSkillPath, 'SKILL.md'))
-          && onboardingMarker?.schemaVersion === 'foggy-managed-skill/v1'
-          && onboardingMarker?.packageVersion === manifest.packageVersion
-        ),
-        version: state?.skills?.onboarding?.version ?? state?.packageVersion ?? manifest.packageVersion,
-      },
-      projectContext: {
-        installed: Boolean(
-          context?.schemaVersion === 'foggy-deepseek-harness-context/v1'
-          && context?.packageVersion === manifest.packageVersion
-          && context?.projectRoot === projectRoot
-          && context?.installStatePath === statePath
-        ),
-        version: context?.schemaVersion ?? 'foggy-deepseek-harness-context/v1',
+        installed: await exists(join(onboardingSkillPath, 'SKILL.md')),
+        version: manifest.packageVersion,
+        provider: 'foggy-managed-skills',
       },
     }
     const installed = components.cli.installed
       && components.launcher.installed
       && components.analysisSkill.installed
       && components.onboardingSkill.installed
-      && components.projectContext.installed
     const running = Boolean(runtime && processRunning(Number(runtime.pid)))
     const progress = await readOptionalJson(progressPath)
     let operation = operationView(this.operation)
@@ -222,8 +216,6 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
       running,
       runtimeUrl: running ? runtime.runtimeUrl ?? null : null,
       roots,
-      projectRoot,
-      contextPath,
       components,
       operation,
       next: installed ? (running ? 'configure-database' : 'start-runtime') : 'initialize',
@@ -236,13 +228,14 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
     return {
       success: true,
       roots,
-      projectRoot: process.env.FOGGY_PROJECT_ROOT || process.cwd(),
+      workspaceMode: 'dsh-session-cwd',
       versions: Object.fromEntries(Object.entries(manifest.components).map(([name, value]) => [name, value.version])),
       operations: [
         'create isolated Python environment',
         'download and verify pinned CLI and Launcher assets',
-        'install Foggy analysis and onboarding Skills into the workspace',
-        'write global install state and project-relative discovery context',
+        'install the Foggy analysis Skill into the global managed component directory',
+        'register onboarding and analysis Skills through the native DSH Skill registry',
+        'write global install state; resolve each workspace from the DSH session cwd',
       ],
       secretsInDshSettings: false,
     }
@@ -269,7 +262,7 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
       return { success: false, accepted: false, operation: operationView(this.operation), error: 'another Foggy operation is running' }
     }
     const id = `${Date.now()}-${Math.random().toString(16).slice(2, 10)}`
-    const args = explicitArgs ?? ['install', '--project-root', process.env.FOGGY_PROJECT_ROOT || process.cwd()]
+    const args = explicitArgs ?? ['install']
     if (!explicitArgs) {
       const roots = defaultRoots()
       args.push('--progress-file', join(roots.dataRoot, 'operation-progress.json'), '--operation-id', id, '--operation-kind', kind)
@@ -304,6 +297,7 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
         operation.state = result.success === false ? 'failed' : 'succeeded'
         operation.result = result
         operation.finishedAt = new Date().toISOString()
+        this.skillProviderControl?.invalidate()
         if (operation.progress) {
           operation.progress = {
             ...operation.progress,
@@ -318,6 +312,7 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
         operation.state = 'failed'
         operation.error = String(error.message ?? error)
         operation.finishedAt = new Date().toISOString()
+        this.skillProviderControl?.invalidate()
         if (operation.progress) {
           operation.progress = {
             ...operation.progress,

package/lib/skill-provider.js

@@ -0,0 +1,111 @@
+import { access, readFile } from 'node:fs/promises'
+import { constants as fsConstants } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { BUNDLED_SKILL_RANK } from '@deepseek-ai/dsh-skill'
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)))
+const onboardingRoot = join(packageRoot, 'skills', 'foggy-deepseek-onboarding')
+const onboardingPath = join(onboardingRoot, 'SKILL.md')
+const providerName = 'foggy-managed-skills'
+const invocation = { modelInvocable: true, userInvocable: true }
+
+async function exists(path) {
+  try {
+    await access(path, fsConstants.F_OK)
+    return true
+  } catch {
+    return false
+  }
+}
+
+async function readOptionalJson(path) {
+  try {
+    return JSON.parse(await readFile(path, 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+function parseSkill(source, expectedName) {
+  const match = source.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/)
+  if (!match) throw new Error(`Foggy Skill ${expectedName} has no valid frontmatter`)
+  const metadata = Object.fromEntries(match[1].split(/\r?\n/).flatMap((line) => {
+    const separator = line.indexOf(':')
+    if (separator < 1) return []
+    return [[line.slice(0, separator).trim(), line.slice(separator + 1).trim().replace(/^(['\"])(.*)\1$/, '$2')]]
+  }))
+  if (metadata.name !== expectedName || !metadata.description) {
+    throw new Error(`Foggy Skill ${expectedName} has invalid name or description metadata`)
+  }
+  return { metadata, content: match[2] }
+}
+
+function candidate(name, description, path, source) {
+  const root = dirname(path)
+  return {
+    name,
+    description,
+    invocation,
+    provider: providerName,
+    source,
+    resourceBase: { kind: 'directory', path: root },
+    rank: BUNDLED_SKILL_RANK,
+    locator: { name, path },
+    path,
+  }
+}
+
+async function managedAnalysisSkill(installRoot, manifest) {
+  const state = await readOptionalJson(join(installRoot, 'install-state.json'))
+  const path = state?.skills?.analysis?.path
+  if (!path || !await exists(join(path, 'SKILL.md'))) return null
+  const marker = await readOptionalJson(join(path, '.foggy-managed-skill.json'))
+  if (
+    marker?.schemaVersion !== 'foggy-managed-skill/v1'
+    || marker?.kind !== 'analysis'
+    || marker?.componentVersion !== manifest.components.analysisSkill.version
+  ) return null
+  return join(path, 'SKILL.md')
+}
+
+export function createFoggySkillProvider({ installRoot, versionsFile }) {
+  return {
+    name: providerName,
+    async list(options = {}) {
+      if (options.signal?.aborted) return []
+      const manifest = await readOptionalJson(versionsFile)
+      const onboarding = parseSkill(await readFile(onboardingPath, 'utf8'), 'foggy-deepseek-onboarding')
+      const result = [candidate(
+        'foggy-deepseek-onboarding',
+        onboarding.metadata.description,
+        onboardingPath,
+        'bundled',
+      )]
+      if (!manifest) return result
+      const analysisPath = await managedAnalysisSkill(installRoot, manifest)
+      if (analysisPath) {
+        const analysis = parseSkill(await readFile(analysisPath, 'utf8'), 'foggy-ai-analysis')
+        result.push(candidate('foggy-ai-analysis', analysis.metadata.description, analysisPath, 'bundled'))
+      }
+      return result
+    },
+    async get(selected, options = {}) {
+      if (options.signal?.aborted) return undefined
+      const locator = selected?.locator
+      if (!locator?.name || !locator?.path || !await exists(locator.path)) return undefined
+      const parsed = parseSkill(await readFile(locator.path, 'utf8'), locator.name)
+      return {
+        name: locator.name,
+        description: parsed.metadata.description,
+        invocation,
+        provider: providerName,
+        source: selected.source,
+        resourceBase: { kind: 'directory', path: dirname(locator.path) },
+        content: parsed.content,
+        path: locator.path,
+        metadata: parsed.metadata,
+      }
+    },
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foggy-projects/deepseek-harness-plugin",
-  "version": "0.4.0-beta.4",
+  "version": "0.4.0-beta.6",
   "description": "Foggy Java data analysis engine integration for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",
@@ -50,10 +50,11 @@
     "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-settings": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-skill": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-typert-protocol": "^0.1.1-rc.2"
   },
   "scripts": {
-    "check": "node --check lib/index.js && node --check lib/client.js && node --check lib/typert.js && node --check lib/remote.js",
-    "test": "node --test test/package.test.js"
+    "check": "node --check lib/index.js && node --check lib/skill-provider.js && node --check lib/client.js && node --check lib/typert.js && node --check lib/remote.js",
+    "test": "node --test test/package.test.js && python test/onboarding_unit.py"
   }
 }

package/skills/foggy-deepseek-onboarding/SKILL.md

@@ -7,22 +7,29 @@ description: Install and operate a pinned Foggy CLI-first dev/test environment f
 
 Set up Foggy through shell and `foggy-runtime` CLI. Do not configure Foggy MCP for this local workflow.
 
-## Installed-context gate
-
-Before deciding that Foggy, its CLI, or either Skill is missing, look for the project-relative file
-`.foggy/deepseek-harness/context.json` from the current workspace root:
-
-- Treat a valid `foggy-deepseek-harness-context/v1` document as the discovery pointer to the global
-  install state, absolute managed CLI command, Runtime state, and both installed Skills.
-- Confirm the installation with this Skill's `doctor` wrapper. The absence of `foggy-runtime` from
-  `PATH` is not evidence that the managed CLI is missing; the plugin intentionally installs it in an
-  isolated environment and records its absolute command in the context and install-state files.
-- Do not independently download or reinstall the CLI when valid project context exists. If the
-  context, a managed marker, or a Skill is missing or invalid, ask the user to open the Foggy plugin
-  settings and use **Re-download / Repair**. That operation regenerates context and restores managed
-  Skills, preserving a backup of modified or outdated Skill directories.
-- If the plugin reports ready but this Skill was restored during the current Harness task, tell the
-  user that a new task or Harness restart may be needed for the Skill registry to reload.
+## Native registry and installed-state gate
+
+This Skill is registered by the Foggy plugin through DeepSeek Harness's native Skill registry. Its
+resource base is the authoritative location for these scripts and references; do not search for or
+copy this Skill into the current workspace.
+
+- Resolve the global install state from the platform default component directory: on Linux use
+  `${XDG_DATA_HOME:-$HOME/.local/share}/foggy/deepseek-harness/install-state.json`; on Windows use
+  `%LOCALAPPDATA%\Foggy\DeepSeekHarness\install-state.json`.
+- Confirm the installation with this Skill's `doctor` wrapper and pass the current DSH session
+  workspace as `--project-root`. The absence of `foggy-runtime` from `PATH` is not evidence that the
+  managed CLI is missing; the plugin intentionally installs it in an isolated environment and records
+  its absolute command in the global install state.
+- Do not independently download or reinstall the CLI. If the global install state, managed marker, or
+  analysis Skill is missing or invalid, ask the user to open the Foggy plugin settings and use
+  **Re-download / Repair**. Repair restores the global managed analysis Skill and invalidates the
+  native DSH Skill catalog. Reinstall or upgrade the plugin itself to restore this bundled Skill.
+- Treat the current DSH session workspace as the authoritative `projectRoot` for the whole onboarding
+  run. Do not redirect semantic drafts or contracts to a different repository merely because another
+  Skill or example was found there. Place non-secret contracts below
+  `<projectRoot>/.foggy/onboarding-contracts/<profile>/`, drafts below
+  `<projectRoot>/.foggy/onboarding-drafts/<profile>/`, and published files below the approved
+  project-relative `modelsDir`.
 
 ## Mandatory orchestration boundary
 
@@ -45,6 +52,9 @@ For every new-database onboarding session, this Skill is the orchestration autho
 - Never read query-execution evidence back into the conversation. Report only validation state,
   execution state, row count, and evidence path; do not report row values or generated SQL containing
   business literals.
+- Prefer one composite command per approval boundary. Do not inspect this Skill's Python implementation
+  or the CLI package source during a normal run; use the documented command contract and inspect code
+  only after a structured wrapper error requires troubleshooting.
 
 ## Boundaries
 
@@ -59,20 +69,22 @@ For every new-database onboarding session, this Skill is the orchestration autho
 
 ## Workflow
 
-1. Read `.foggy/deepseek-harness/context.json`, then run `scripts/doctor.ps1 --project-root <root>` on Windows or
-   `bash scripts/doctor.sh --project-root <root>` on Linux.
-2. If the pinned CLI, Launcher, project context, or either managed Skill is missing, use the Foggy
+1. Run `scripts/doctor.ps1 --project-root <current-session-workspace>` on Windows or
+   `bash scripts/doctor.sh --project-root <current-session-workspace>` on Linux.
+2. If the pinned CLI, Launcher, or global managed analysis Skill is missing, use the Foggy
    plugin's Repair action. Use the matching install script only when the plugin UI is unavailable;
    use `--dry-run` first when paths or permissions are uncertain.
 3. Run `runtime-start` and require successful `wait-ready` plus `capabilities`. Record engine,
    Runtime API version, schema version, security mode, URL, namespace, PID, and evidence path.
-4. Confirm the project contains `.agents/skills/foggy-ai-analysis/SKILL.md`.
+4. Load `foggy-ai-analysis` from the native DSH Skill registry. Do not require a workspace copy.
 5. For a new business database, read [references/onboarding-workflow.md](references/onboarding-workflow.md)
    and prefer its two composite `onboard-datasource-run` / `onboard-semantic-run` commands. Require the
-   trusted operator to create the private CLI profile outside Harness. Accept only the opaque profile
+   trusted operator to create the private CLI profile outside Harness. Unless the operator explicitly
+   overrides it, use the persistent profile store reported by the wrapper under the Foggy data root
+   (`<dataRoot>/cli-profiles`), never `/tmp`. Accept only the opaque profile
    ID, exact revision, datasource name/type, and namespace; never request JDBC URL, username,
    password, or password environment-variable name in Harness.
-6. After schema discovery, use `foggy-ai-analysis` only to author TM/QM files in a separate project-local
+6. After schema discovery, use `foggy-ai-analysis` only to author TM/QM files in the standard project-local
    draft directory. Register, validate, publish, and verify them through this Skill's wrapper using the deterministic commands in
    [references/onboarding-workflow.md](references/onboarding-workflow.md). Do not publish, prune, replace
    a bundle, or execute a business-data query without the matching explicit flag and user approval.
@@ -97,5 +109,10 @@ In DeepSeek Harness, do not expand the composite onboarding commands back into t
 operations. This order documents what the wrapper enforces internally and becomes a direct CLI workflow
 only after onboarding is complete.
 
+Composite commands are checkpointed and idempotent: a retry skips completed datasource, validation,
+publication, and verification phases when the approved contract and draft digest are unchanged. Fix a
+query payload in place and rerun the same semantic composite command; do not remove a successfully
+published bundle merely to recover from a later query-validation failure.
+
 Keep user business data separate from the sales-drop SQLite demo. Prefer a read-only database account,
 opaque CLI profile references, and bounded query limits.

package/skills/foggy-deepseek-onboarding/assets/versions.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "foggy-deepseek-onboarding-versions/v1",
-  "packageVersion": "0.4.0-beta.4",
-  "validatedAt": "2026-08-28",
+  "packageVersion": "0.4.0-beta.6",
+  "validatedAt": "2026-09-01",
   "components": {
     "deepseekHarness": {
       "version": "0.1.1-rc.2",

package/skills/foggy-deepseek-onboarding/references/onboarding-workflow.md

@@ -23,6 +23,16 @@ to paste a password and do not put a JDBC URL, username, password environment-va
 line, logs, or evidence. For non-SQLite databases, ask the user to set the named environment variable
 before Runtime starts so the Java process inherits it. Recommend a read-only database account.
 
+Use the current DSH session workspace as `projectRoot`. Store approved non-secret contracts at
+`.foggy/onboarding-contracts/<profile>/`, semantic drafts at `.foggy/onboarding-drafts/<profile>/`, and
+command evidence at `.foggy/onboarding-command-evidence/<profile>/`. Do not split these files across the
+session workspace and a separate example repository. The wrapper rejects a query payload outside the
+recorded project root before any semantic validation or publication mutation occurs.
+
+The wrapper defaults `FOGGY_RUNTIME_PROFILE_STORE` to the private persistent directory
+`<dataRoot>/cli-profiles`. An explicit operator-provided value still wins. Do not use `/tmp` for a profile
+that must survive a WSL or Harness restart.
+
 Treat every user-supplied identifier and bound as immutable input: profile, datasource, namespace,
 models directory, bundle name, TM/QM name, query fields, and limit. Do not swap in demo names, add
 fields, raise the limit, or introduce replacement flags. If one of these inputs is missing, pause for
@@ -53,6 +63,13 @@ onboard-semantic-run --semantic-plan <approved-json> --query-payload <approved-j
 Include an approval flag only after the user approves that exact action. Without it, the composite
 command stops after the corresponding dry-run and returns `phaseStatus=awaiting-...-approval`.
 
+Both composite commands are resumable. When the approved contract is unchanged, they skip completed
+checkpoints instead of re-adding an existing datasource, revalidating an already published draft, or
+registering the same bundle twice. If query validation fails after publication, correct the project-local
+payload and rerun `onboard-semantic-run`; it resumes at query verification and leaves the active bundle in
+place. A same-name datasource is accepted idempotently only when its public name and database type match
+the approved plan; otherwise replacement still requires explicit approval.
+
 The granular commands below remain available for manual troubleshooting and resumption. Do not expand
 the composite commands into this list during a normal Harness turn.
 
@@ -111,6 +128,11 @@ requires an integer `limit` from 1 through 100. The first `semantic-verify` call
 validates the query; only `--execute` reads business data. Full results stay in evidence and the command
 returns only counts and paths.
 
+Before the first semantic mutation, the composite command checks that the query payload is inside
+`projectRoot`, has a bounded limit, and targets a query model declared in the approved semantic plan.
+After publication, `semantic-verify` always describes the live model before validation. If a field is
+rejected, update the payload from those described names and rerun the same composite command.
+
 Do not open, summarize, or quote `query-execute.json` or the Runtime's generated SQL after execution.
 The conversational result may contain only `queryValidated`, `queryExecuted`, `rowCount`, the model
 name, and the evidence path. A successful direct CLI command is not proof that onboarding completed;