@foggy-projects/deepseek-harness-plugin 0.4.0-beta.5 → 0.4.0-beta.7

package/skills/foggy-deepseek-onboarding/scripts/onboarding.py

@@ -34,6 +34,7 @@ PROFILE_PATTERN = re.compile(r"^[a-z0-9][a-z0-9._-]{0,62}$")
 ENV_NAME_PATTERN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*$")
 OPAQUE_PROFILE_PATTERN = re.compile(r"^fop_[a-f0-9]{32}$")
 OPAQUE_REVISION_PATTERN = re.compile(r"^sha256:[a-f0-9]{64}$")
+OPAQUE_PROFILE_SCHEMA = "foggy-runtime-onboarding-profile/v1"
 MODEL_NAME_PATTERN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]{0,127}$")
 
 
@@ -283,11 +284,20 @@ def materialize(
     progress_index: int = 0,
     progress_total: int = 1,
     progress_message: str = "Downloading and verifying asset",
+    replace_corrupt: bool = False,
 ) -> dict:
     destination.parent.mkdir(parents=True, exist_ok=True)
     if destination.is_file():
-        verify_asset(destination, asset["sha256"])
-        return {"file": asset["file"], "path": str(destination), "source": "existing", "sha256": asset["sha256"]}
+        try:
+            verify_asset(destination, asset["sha256"])
+            return {"file": asset["file"], "path": str(destination), "source": "existing", "sha256": asset["sha256"]}
+        except OnboardingError:
+            if not replace_corrupt:
+                raise
+            quarantine = destination.with_name(
+                destination.name + f".corrupt-{dt.datetime.now().strftime('%Y%m%d-%H%M%S-%f')}"
+            )
+            destination.replace(quarantine)
     cached = cached_asset(asset["file"], asset["sha256"], cache_dirs)
     if cached:
         shutil.copy2(cached, destination)
@@ -448,6 +458,180 @@ def onboarding_state_path(data_root: Path, profile: str) -> Path:
     return data_root / "onboarding" / "profiles" / f"{safe_profile(profile)}.json"
 
 
+def configure_profile_store(data_root: Path, *, create: bool = True) -> Path:
+    """Keep opaque CLI profiles in the persistent, private Foggy data root by default."""
+    configured = os.environ.get("FOGGY_RUNTIME_PROFILE_STORE")
+    destination = normalized(configured) if configured else data_root / "cli-profiles"
+    if not configured:
+        os.environ["FOGGY_RUNTIME_PROFILE_STORE"] = str(destination)
+    if create:
+        destination.mkdir(parents=True, exist_ok=True)
+        if os.name != "nt":
+            destination.chmod(0o700)
+    return destination
+
+
+def legacy_profile_stores(destination: Path) -> list[Path]:
+    configured = [
+        normalized(item)
+        for item in os.environ.get("FOGGY_RUNTIME_PROFILE_LEGACY_STORES", "").split(os.pathsep)
+        if item.strip()
+    ]
+    default_legacy = Path(tempfile.gettempdir()) / "foggy-profiles"
+    candidates = [*configured, normalized(default_legacy)]
+    unique: list[Path] = []
+    for candidate in candidates:
+        if candidate == destination or candidate in unique:
+            continue
+        unique.append(candidate)
+    return unique
+
+
+def validate_opaque_profile_document(payload: dict, path: Path) -> dict:
+    allowed = {"schemaVersion", "profileId", "revision", "createdAt", "updatedAt", "connection"}
+    unexpected = sorted(set(payload) - allowed)
+    if unexpected:
+        raise OnboardingError(f"Unsupported opaque profile fields in {path.name}: {', '.join(unexpected)}")
+    if payload.get("schemaVersion") != OPAQUE_PROFILE_SCHEMA:
+        raise OnboardingError(f"Unexpected opaque profile schema in {path.name}")
+    profile_id = payload.get("profileId")
+    revision = payload.get("revision")
+    if not isinstance(profile_id, str) or not OPAQUE_PROFILE_PATTERN.fullmatch(profile_id):
+        raise OnboardingError(f"Invalid opaque profile ID in {path.name}")
+    if path.stem != profile_id:
+        raise OnboardingError(f"Opaque profile filename does not match its ID: {path.name}")
+    if not isinstance(revision, str) or not OPAQUE_REVISION_PATTERN.fullmatch(revision):
+        raise OnboardingError(f"Invalid opaque profile revision in {path.name}")
+    connection = payload.get("connection")
+    if not isinstance(connection, dict):
+        raise OnboardingError(f"Opaque profile connection is missing in {path.name}")
+    allowed_connection = {"name", "type", "jdbcUrl", "username", "passwordEnv", "namespace"}
+    unexpected_connection = sorted(set(connection) - allowed_connection)
+    if unexpected_connection:
+        raise OnboardingError(
+            f"Unsupported opaque connection fields in {path.name}: {', '.join(unexpected_connection)}"
+        )
+    for name in ("name", "type", "jdbcUrl", "namespace"):
+        if not isinstance(connection.get(name), str) or not connection[name].strip():
+            raise OnboardingError(f"Opaque profile connection.{name} is invalid in {path.name}")
+    password_env = connection.get("passwordEnv")
+    if password_env is not None and (
+        not isinstance(password_env, str) or not ENV_NAME_PATTERN.fullmatch(password_env)
+    ):
+        raise OnboardingError(f"Opaque profile passwordEnv is invalid in {path.name}")
+    jdbc_url = connection["jdbcUrl"]
+    if re.search(r"(?i)(?:password|passwd|pwd)\s*=", jdbc_url) or re.search(r"//[^/@:]+:[^/@]+@", jdbc_url):
+        raise OnboardingError(f"Opaque profile embeds a password in jdbcUrl: {path.name}")
+    return payload
+
+
+def profile_migration_inventory(data_root: Path) -> dict:
+    destination = configure_profile_store(data_root, create=False)
+    entries: list[dict] = []
+    for source in legacy_profile_stores(destination):
+        if not source.is_dir():
+            continue
+        for path in sorted(source.glob("fop_*.json")):
+            try:
+                payload = validate_opaque_profile_document(read_json_object(path, "Opaque profile"), path)
+                target = destination / path.name
+                status = "pending"
+                if target.is_file():
+                    existing = validate_opaque_profile_document(read_json_object(target, "Opaque profile"), target)
+                    status = "migrated" if existing == payload else "conflict"
+                entries.append({
+                    "profileId": payload["profileId"],
+                    "revision": payload["revision"],
+                    "source": str(source),
+                    "destination": str(destination),
+                    "status": status,
+                })
+            except OnboardingError as exc:
+                entries.append({
+                    "profileId": path.stem if OPAQUE_PROFILE_PATTERN.fullmatch(path.stem) else None,
+                    "source": str(source),
+                    "destination": str(destination),
+                    "status": "invalid",
+                    "error": str(exc),
+                })
+    return {
+        "schemaVersion": "foggy-deepseek-profile-migration-status/v1",
+        "profileStore": str(destination),
+        "legacyStores": [str(path) for path in legacy_profile_stores(destination)],
+        "entries": entries,
+        "pendingCount": sum(item["status"] == "pending" for item in entries),
+        "conflictCount": sum(item["status"] in {"conflict", "invalid"} for item in entries),
+    }
+
+
+def profile_migration_status_command(args: argparse.Namespace) -> dict:
+    install_root = normalized(args.install_root or default_install_root())
+    install_state = read_install_state(install_root)
+    data_root = normalized(args.data_root or install_state["dataRoot"])
+    return {"success": True, **profile_migration_inventory(data_root), "productionReady": False}
+
+
+def profile_migrate_command(args: argparse.Namespace) -> dict:
+    if not args.approve:
+        raise OnboardingError("Profile migration requires --approve")
+    install_root = normalized(args.install_root or default_install_root())
+    install_state = read_install_state(install_root)
+    data_root = normalized(args.data_root or install_state["dataRoot"])
+    inventory = profile_migration_inventory(data_root)
+    if inventory["conflictCount"]:
+        raise OnboardingError("Legacy profile migration has conflicts or invalid entries; inspect status first")
+    destination = configure_profile_store(data_root)
+    migrated: list[dict] = []
+    for item in inventory["entries"]:
+        if item["status"] != "pending":
+            continue
+        source = normalized(Path(item["source"]) / f"{item['profileId']}.json")
+        payload = validate_opaque_profile_document(read_json_object(source, "Opaque profile"), source)
+        target = destination / source.name
+        atomic_json(target, payload)
+        if os.name != "nt":
+            target.chmod(0o600)
+        if read_json_object(target, "Migrated opaque profile") != payload:
+            target.unlink(missing_ok=True)
+            raise OnboardingError(f"Migrated profile verification failed: {source.name}")
+        backup_root = data_root / "profile-migration-backups" / dt.datetime.now().strftime("%Y%m%d-%H%M%S-%f")
+        backup_root.mkdir(parents=True, exist_ok=True)
+        if os.name != "nt":
+            backup_root.chmod(0o700)
+        archived = backup_root / (source.name + ".bak")
+        source.replace(archived)
+        if os.name != "nt":
+            archived.chmod(0o600)
+        migrated.append({
+            "profileId": payload["profileId"],
+            "revision": payload["revision"],
+            "destination": str(target),
+            "legacyBackup": str(archived),
+        })
+    return {
+        "success": True,
+        "schemaVersion": "foggy-deepseek-profile-migration/v1",
+        "profileStore": str(destination),
+        "migrated": migrated,
+        "migratedCount": len(migrated),
+        "productionReady": False,
+    }
+
+
+def resolve_profile_name(data_root: Path, requested: str | None) -> str:
+    if requested:
+        return safe_profile(requested)
+    profiles_dir = data_root / "onboarding" / "profiles"
+    candidates = sorted(path.stem for path in profiles_dir.glob("*.json") if PROFILE_PATTERN.fullmatch(path.stem))
+    if len(candidates) == 1:
+        return candidates[0]
+    if not candidates:
+        return "default"
+    raise OnboardingError(
+        "Multiple onboarding profiles exist; pass --profile explicitly: " + ", ".join(candidates)
+    )
+
+
 def read_onboarding_state(data_root: Path, profile: str, required: bool = True) -> dict | None:
     path = onboarding_state_path(data_root, profile)
     if not path.is_file():
@@ -798,21 +982,26 @@ def install_command(args: argparse.Namespace) -> dict:
     data_root = normalized(args.data_root or default_data_root())
     cache_dirs = [normalized(item) for item in args.asset_cache_dir]
     components = versions["components"]
+    repair_component = getattr(args, "repair_component", None)
     assert_managed_root(install_root, "Install root")
     assert_managed_root(data_root, "Data root")
     if install_root == data_root:
         raise OnboardingError("Install root and data root must be different")
+    profile_store = normalized(os.environ.get("FOGGY_RUNTIME_PROFILE_STORE") or data_root / "cli-profiles")
     plan = {
         "schemaVersion": "foggy-deepseek-onboarding-plan/v1",
         "installRoot": str(install_root),
         "dataRoot": str(data_root),
+        "profileStore": str(profile_store),
         "workspaceMode": "dsh-session-cwd",
         "versions": {name: value.get("version") for name, value in components.items()},
+        "repairComponent": repair_component,
         "operations": ["install isolated CLI", "verify Launcher assets", "install global analysis Skill", "write install state"],
         "productionReady": False,
     }
     if args.dry_run:
         return {"success": True, "dryRun": True, "plan": plan}
+    profile_store = configure_profile_store(data_root)
     progress = ProgressReporter(
         getattr(args, "progress_file", None),
         getattr(args, "operation_id", None),
@@ -840,6 +1029,7 @@ def install_command(args: argparse.Namespace) -> dict:
             progress=progress, progress_phase="cli", progress_step=1,
             progress_index=index, progress_total=len(cli_assets),
             progress_message="Downloading and verifying CLI",
+            replace_corrupt=repair_component == "cli",
         ))
         progress.update(
             "cli", 1, "Downloading and verifying CLI",
@@ -895,6 +1085,7 @@ def install_command(args: argparse.Namespace) -> dict:
             progress=progress, progress_phase="launcher", progress_step=2,
             progress_index=index, progress_total=len(launcher_assets),
             progress_message="Downloading and verifying Launcher",
+            replace_corrupt=repair_component == "launcher",
         ))
         progress.update(
             "launcher", 2, "Downloading and verifying Launcher",
@@ -917,6 +1108,7 @@ def install_command(args: argparse.Namespace) -> dict:
             progress=progress, progress_phase="analysis-skill", progress_step=3,
             progress_index=index, progress_total=len(analysis_assets),
             progress_message="Downloading and verifying analysis Skill",
+            replace_corrupt=repair_component == "analysis-skill",
         ))
         progress.update(
             "analysis-skill", 3, "Downloading and verifying analysis Skill",
@@ -927,7 +1119,7 @@ def install_command(args: argparse.Namespace) -> dict:
     progress.update("analysis-skill", 3, "Installing analysis Skill", fraction=0.9, current_file=zip_asset["file"])
     analysis_skill = install_analysis_skill(
         downloads / "skill" / zip_asset["file"], install_root, components["analysisSkill"]["version"],
-        zip_asset["sha256"], versions["packageVersion"], args.replace_skill,
+        zip_asset["sha256"], versions["packageVersion"], args.replace_skill or repair_component == "analysis-skill",
     )
     progress.update("analysis-skill", 3, "Analysis Skill ready", fraction=1.0)
     progress.update("workspace-skills", 4, "Registering native DSH Skills", fraction=0.1)
@@ -945,6 +1137,7 @@ def install_command(args: argparse.Namespace) -> dict:
         "packageVersion": versions["packageVersion"],
         "installRoot": str(install_root),
         "dataRoot": str(data_root),
+        "profileStore": str(profile_store),
         "workspaceMode": "dsh-session-cwd",
         "cli": {"version": cli_component["version"], "command": str(cli_command), "mode": cli_mode},
         "launcher": {"version": components["launcher"]["version"], "path": str(launcher_dir)},
@@ -1057,8 +1250,61 @@ def runtime_start_command(args: argparse.Namespace) -> dict:
     existing = data_root / "runtime-state.json"
     if existing.is_file():
         prior = json.loads(existing.read_text(encoding="utf-8"))
-        if process_info(int(prior.get("pid", 0)))["running"]:
-            raise OnboardingError(f"Recorded Runtime is already running with PID {prior['pid']}")
+        prior_info = process_info(int(prior.get("pid", 0)))
+        if prior_info["running"]:
+            expected_jar = f"foggy-runtime-launcher-{state['launcher']['version']}.jar"
+            if prior_info.get("commandLine") and expected_jar not in prior_info["commandLine"]:
+                raise OnboardingError(
+                    f"Recorded Runtime PID {prior['pid']} does not match the pinned Launcher"
+                )
+            cli = state["cli"]["command"]
+            namespace = args.namespace or prior.get("namespace") or versions["defaults"]["namespace"]
+            base_url = prior.get("runtimeUrl")
+            if not isinstance(base_url, str) or not base_url:
+                raise OnboardingError("Recorded Runtime does not contain runtimeUrl")
+            wait_result = command_result(
+                [cli, "--base-url", base_url, "--namespace", namespace, "--output", "json", "wait-ready",
+                 "--timeout-seconds", str(args.timeout or versions["defaults"]["readinessTimeoutSeconds"]),
+                 "--interval-seconds", "1"],
+                timeout=(args.timeout or versions["defaults"]["readinessTimeoutSeconds"]) + 30,
+            )
+            wait_payload = parse_json_output(wait_result, "wait-ready")
+            if wait_payload.get("success") is not True:
+                raise OnboardingError("wait-ready returned success=false for recorded Runtime")
+            capabilities = parse_json_output(
+                command_result(
+                    [cli, "--base-url", base_url, "--namespace", namespace, "--output", "json", "capabilities"],
+                    timeout=30,
+                ),
+                "capabilities",
+            )
+            expected_contract = versions["components"]["launcher"]["runtimeApiContract"]
+            if capabilities.get("success") is not True or capabilities.get("runtimeApiVersion") != expected_contract:
+                raise OnboardingError(f"Unexpected Runtime API contract; expected {expected_contract}")
+            if capabilities.get("data", {}).get("securityMode") != versions["defaults"]["securityMode"]:
+                raise OnboardingError("Recorded Runtime did not report the expected dev/test security mode")
+            verified_at = now_utc()
+            identity = {
+                "engine": capabilities.get("engine"),
+                "runtimeApiVersion": capabilities.get("runtimeApiVersion"),
+                "schemaVersion": capabilities.get("data", {}).get("schemaVersion"),
+                "securityMode": capabilities.get("data", {}).get("securityMode"),
+            }
+            return {
+                "success": True,
+                **prior,
+                "identity": identity,
+                "lastVerifiedAt": verified_at,
+                "verification": {
+                    "waitReady": True,
+                    "capabilities": identity,
+                    "persisted": False,
+                    "instruction": "Capture this JSON in the current workspace when fresh verification evidence is required",
+                },
+                "action": "already-running-verified",
+                "resumed": True,
+                "productionReady": False,
+            }
         existing.unlink()
     port = args.port or int(versions["defaults"]["port"])
     with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as probe:
@@ -1163,6 +1409,7 @@ def onboarding_context(args: argparse.Namespace, require_runtime: bool = False)
     install_state = read_install_state(install_root)
     data_root = normalized(args.data_root or install_state["dataRoot"])
     assert_managed_root(data_root, "Data root")
+    configure_profile_store(data_root, create=False)
     runtime_state_path = data_root / "runtime-state.json"
     runtime_state = read_json_object(runtime_state_path, "Runtime state") if runtime_state_path.is_file() else None
     if runtime_state and runtime_state.get("schemaVersion") != RUNTIME_STATE_SCHEMA:
@@ -1222,6 +1469,28 @@ def require_opaque_profile_cli(install_state: dict) -> None:
         )
 
 
+def datasource_entries(payload: dict) -> list[dict]:
+    for item in nested_data_objects(payload):
+        entries = item.get("datasources")
+        if isinstance(entries, list):
+            return [entry for entry in entries if isinstance(entry, dict)]
+    return []
+
+
+def matching_datasource(payload: dict, connection: dict) -> dict | None:
+    expected_name = connection["name"]
+    expected_type = connection["type"].lower()
+    if expected_type == "postgresql":
+        expected_type = "postgres"
+    for entry in datasource_entries(payload):
+        entry_type = str(entry.get("type", "")).lower()
+        if entry_type == "postgresql":
+            entry_type = "postgres"
+        if entry.get("name") == expected_name and entry_type == expected_type:
+            return entry
+    return None
+
+
 def onboarding_plan_command(args: argparse.Namespace) -> dict:
     install_root, install_state, data_root, runtime_state = onboarding_context(args, require_runtime=False)
     profile = safe_profile(args.profile)
@@ -1283,7 +1552,9 @@ def onboarding_plan_command(args: argparse.Namespace) -> dict:
 
 def require_profile(args: argparse.Namespace, require_runtime: bool = False) -> tuple[dict, dict, Path, dict | None]:
     _install_root, install_state, data_root, runtime_state = onboarding_context(args, require_runtime=require_runtime)
-    state = read_onboarding_state(data_root, safe_profile(args.profile))
+    profile = resolve_profile_name(data_root, getattr(args, "profile", None))
+    args.profile = profile
+    state = read_onboarding_state(data_root, profile)
     if normalized(state["installRoot"]) != normalized(install_state["installRoot"]):
         raise OnboardingError("Onboarding profile belongs to a different install root")
     return state, install_state, data_root, runtime_state
@@ -1329,10 +1600,31 @@ def datasource_configure_command(args: argparse.Namespace) -> dict:
         label = "datasources add"
     if args.replace:
         command.append("--replace")
-    result = redact_connection_material(
-        cli_json(install_state, runtime_state, connection["namespace"], command, label)
-    )
-    mark_step(state, "datasourceConfigured", "completed", replace=args.replace)
+    already_present = False
+    try:
+        result = redact_connection_material(
+            cli_json(install_state, runtime_state, connection["namespace"], command, label)
+        )
+    except OnboardingError as exc:
+        if "DATASOURCE_ALREADY_EXISTS" not in str(exc):
+            raise
+        listed = cli_json(
+            install_state, runtime_state, connection["namespace"], ["datasources", "list"], "datasources list"
+        )
+        existing = matching_datasource(listed, connection)
+        if existing is None:
+            raise OnboardingError(
+                f"Datasource {connection['name']} already exists but its public type does not match the approved plan; "
+                "do not replace it without explicit approval"
+            ) from exc
+        already_present = True
+        result = {
+            "success": True,
+            "idempotent": True,
+            "status": "already-present",
+            "dataSource": redact_connection_material(existing),
+        }
+    mark_step(state, "datasourceConfigured", "completed", replace=args.replace, alreadyPresent=already_present)
     path = write_onboarding_state(data_root, state)
     return {
         "success": True,
@@ -1340,6 +1632,7 @@ def datasource_configure_command(args: argparse.Namespace) -> dict:
         "profile": state["profile"],
         "statePath": str(path),
         "dataSource": connection["name"],
+        "alreadyPresent": already_present,
         "runtime": result,
         "next": "run datasource-verify; add --bind to approve namespace binding",
         "productionReady": False,
@@ -1756,7 +2049,9 @@ def semantic_verify_command(args: argparse.Namespace) -> dict:
         raise OnboardingError("--query-model must be declared in the registered semantic plan")
     if not args.query_payload:
         raise OnboardingError("--query-payload is required for semantic verification")
-    project_root = normalized(state["projectRoot"])
+    project_root = normalized(getattr(args, "project_root", None) or state["projectRoot"])
+    if not project_root_is_bound(state, project_root):
+        raise OnboardingError("Query projectRoot is not bound to this onboarding profile")
     payload_path = normalized(args.query_payload)
     if not is_child(payload_path, project_root):
         raise OnboardingError("Query payload must stay inside projectRoot")
@@ -1798,7 +2093,29 @@ def semantic_verify_command(args: argparse.Namespace) -> dict:
     )
     atomic_json(evidence_dir / "query-execute.json", executed)
     row_count = response_row_count(executed)
-    mark_step(state, "semanticVerified", "completed", queryModel=query_model, queryValidated=True, queryExecuted=True)
+    mark_step(
+        state,
+        "semanticVerified",
+        "completed",
+        queryModel=query_model,
+        queryValidated=True,
+        queryExecuted=True,
+        rowCount=row_count,
+        queryPayloadDigest=sha256(payload_path),
+        projectRoot=str(project_root),
+    )
+    workspace_verifications = state.setdefault("workspaceVerifications", [])
+    workspace_verifications[:] = [
+        item for item in workspace_verifications
+        if not (item.get("projectRoot") == str(project_root) and item.get("queryModel") == query_model)
+    ]
+    workspace_verifications.append({
+        "projectRoot": str(project_root),
+        "queryModel": query_model,
+        "queryPayloadDigest": sha256(payload_path),
+        "rowCount": row_count,
+        "verifiedAt": now_utc(),
+    })
     state.setdefault("artifacts", {})["semanticVerifyEvidence"] = str(evidence_dir)
     path = write_onboarding_state(data_root, state)
     return {
@@ -1818,14 +2135,15 @@ def semantic_verify_command(args: argparse.Namespace) -> dict:
 
 
 def next_onboarding_action(state: dict) -> dict:
+    profile_flag = f" --profile {state['profile']}"
     ordered = [
-        ("datasourceConfigured", "datasource-configure --apply"),
-        ("datasourceVerified", "datasource-verify --bind"),
-        ("schemaDiscovered", "schema-discover"),
-        ("semanticDrafted", "semantic-draft --semantic-plan <json>"),
-        ("semanticValidated", "semantic-validate --apply"),
-        ("semanticPublished", "semantic-publish --apply"),
-        ("semanticVerified", "semantic-verify --query-payload <json> --execute"),
+        ("datasourceConfigured", f"datasource-configure{profile_flag} --apply"),
+        ("datasourceVerified", f"datasource-verify{profile_flag} --bind"),
+        ("schemaDiscovered", f"schema-discover{profile_flag}"),
+        ("semanticDrafted", f"semantic-draft{profile_flag} --semantic-plan <json>"),
+        ("semanticValidated", f"semantic-validate{profile_flag} --apply"),
+        ("semanticPublished", f"semantic-publish{profile_flag} --apply"),
+        ("semanticVerified", f"semantic-verify{profile_flag} --query-payload <json> --execute"),
     ]
     for name, command in ordered:
         current = state.get("steps", {}).get(name, {})
@@ -1838,7 +2156,7 @@ def next_onboarding_action(state: dict) -> dict:
                     "instruction": "Inspect semantic publish evidence and repair refresh before any republish attempt.",
                 }
             if name == "semanticValidated" and current.get("status") == "failed":
-                command = "repair TM/QM, then semantic-draft --semantic-plan <json>"
+                command = f"repair TM/QM, then semantic-draft{profile_flag} --semantic-plan <json>"
             return {"step": name, "command": command, "status": current.get("status", "pending")}
     return {"step": None, "command": None, "status": "completed"}
 
@@ -1856,12 +2174,63 @@ def onboarding_status_command(args: argparse.Namespace) -> dict:
         "passwordEnv": password_env,
         "passwordEnvPresent": bool(password_env and os.environ.get(password_env)),
         "steps": state["steps"],
+        "projectRoot": state.get("projectRoot"),
+        "workspaceBindings": [str(path) for path in bound_project_roots(state)],
+        "workspaceVerifications": state.get("workspaceVerifications", []),
         "artifacts": state.get("artifacts", {}),
         "next": next_onboarding_action(state),
         "productionReady": False,
     }
 
 
+def onboarding_list_command(args: argparse.Namespace) -> dict:
+    install_root = normalized(args.install_root or default_install_root())
+    install_state = read_install_state(install_root)
+    data_root = normalized(args.data_root or install_state["dataRoot"])
+    profiles_dir = data_root / "onboarding" / "profiles"
+    profiles: list[dict] = []
+    ordered_steps = [
+        "planned", "datasourceConfigured", "datasourceVerified", "schemaDiscovered",
+        "semanticDrafted", "semanticValidated", "semanticPublished", "semanticVerified",
+    ]
+    for path in sorted(profiles_dir.glob("*.json")):
+        if not PROFILE_PATTERN.fullmatch(path.stem):
+            continue
+        try:
+            state = read_onboarding_state(data_root, path.stem)
+            steps = state.get("steps", {})
+            completed = sum(steps.get(name, {}).get("status") == "completed" for name in ordered_steps)
+            profiles.append({
+                "profile": state["profile"],
+                "projectRoot": state.get("projectRoot"),
+                "workspaceBindings": [str(item) for item in bound_project_roots(state)],
+                "updatedAt": state.get("updatedAt"),
+                "completedSteps": completed,
+                "totalSteps": len(ordered_steps),
+                "steps": {name: steps.get(name, {"status": "pending"}) for name in ordered_steps},
+                "next": next_onboarding_action(state),
+            })
+        except OnboardingError as exc:
+            profiles.append({
+                "profile": path.stem,
+                "projectRoot": None,
+                "updatedAt": None,
+                "completedSteps": 0,
+                "totalSteps": len(ordered_steps),
+                "steps": {},
+                "next": {"status": "invalid"},
+                "error": str(exc),
+            })
+    profiles.sort(key=lambda item: item.get("updatedAt") or "", reverse=True)
+    return {
+        "success": True,
+        "schemaVersion": "foggy-deepseek-onboarding-list/v1",
+        "profiles": profiles,
+        "profileCount": len(profiles),
+        "productionReady": False,
+    }
+
+
 def onboarding_resume_command(args: argparse.Namespace) -> dict:
     result = onboarding_status_command(args)
     result["schemaVersion"] = "foggy-deepseek-onboarding-resume/v1"
@@ -1883,6 +2252,52 @@ def save_composite_result(evidence_dir: Path, name: str, payload: dict, files: l
     files.append(str(path))
 
 
+def resumed_phase(profile: str, phase: str, **values: object) -> dict:
+    return {
+        "success": True,
+        "schemaVersion": "foggy-deepseek-onboarding-resumed/v1",
+        "profile": profile,
+        "phase": phase,
+        "resumed": True,
+        **values,
+    }
+
+
+def step_completed(state: dict, name: str) -> bool:
+    return state.get("steps", {}).get(name, {}).get("status") == "completed"
+
+
+def bound_project_roots(state: dict) -> list[Path]:
+    values = [state.get("projectRoot"), *state.get("workspaceBindings", [])]
+    result: list[Path] = []
+    for value in values:
+        if not isinstance(value, str) or not value:
+            continue
+        path = normalized(value)
+        if path not in result:
+            result.append(path)
+    return result
+
+
+def project_root_is_bound(state: dict, project_root: Path) -> bool:
+    return normalized(project_root) in bound_project_roots(state)
+
+
+def bind_completed_workspace(state: dict, data_root: Path, project_root: Path) -> bool:
+    project_root = normalized(project_root)
+    if project_root_is_bound(state, project_root):
+        return False
+    required = ("datasourceConfigured", "datasourceVerified", "schemaDiscovered", "semanticPublished")
+    if not all(step_completed(state, name) for name in required):
+        raise OnboardingError(
+            "Existing onboarding profile belongs to a different projectRoot and is not complete enough for safe reuse; "
+            "resume from its original DSH workspace or choose a new profile name"
+        )
+    state.setdefault("workspaceBindings", []).append(str(project_root))
+    write_onboarding_state(data_root, state)
+    return True
+
+
 def datasource_run_command(args: argparse.Namespace) -> dict:
     _install_root, install_state, data_root, _runtime_state = onboarding_context(args, require_runtime=True)
     project_root = normalized(args.project_root or Path.cwd())
@@ -1902,11 +2317,14 @@ def datasource_run_command(args: argparse.Namespace) -> dict:
     if existing:
         if existing.get("connection") != requested_connection:
             raise OnboardingError("Existing onboarding profile does not match the requested connection plan")
+        adopted = bind_completed_workspace(existing, data_root, project_root)
         plan_result = {
             "success": True,
             "schemaVersion": "foggy-deepseek-onboarding-plan-result/v1",
             "profile": profile,
             "resumed": True,
+            "workspaceAdopted": adopted,
+            "projectRoot": str(project_root),
             "statePath": str(onboarding_state_path(data_root, profile)),
             "next": next_onboarding_action(existing),
             "productionReady": False,
@@ -1921,59 +2339,81 @@ def datasource_run_command(args: argparse.Namespace) -> dict:
             replace_plan=False,
         ))
     save_composite_result(evidence_dir, "01-plan.json", plan_result, files)
+    state = read_onboarding_state(data_root, profile)
 
-    configure_dry = datasource_configure_command(argparse.Namespace(
-        install_root=args.install_root, data_root=args.data_root, profile=profile, apply=False, replace=False,
-    ))
-    save_composite_result(evidence_dir, "02-datasource-dry.json", configure_dry, files)
-    if not args.approve_configure:
-        return {
-            "success": True,
-            "schemaVersion": "foggy-deepseek-datasource-run/v1",
-            "profile": profile,
-            "phaseStatus": "awaiting-configure-approval",
-            "evidenceDir": str(evidence_dir),
-            "evidenceFiles": files,
-            "next": "rerun with --approve-configure after the datasource mutation is approved",
-            "productionReady": False,
-        }
-
-    configured = datasource_configure_command(argparse.Namespace(
-        install_root=args.install_root, data_root=args.data_root, profile=profile, apply=True, replace=False,
-    ))
-    save_composite_result(evidence_dir, "03-datasource-apply.json", configured, files)
-    tested = datasource_verify_command(argparse.Namespace(
-        install_root=args.install_root, data_root=args.data_root, profile=profile, bind=False,
-    ))
-    save_composite_result(evidence_dir, "04-datasource-test.json", tested, files)
-    if not args.approve_bind:
-        return {
-            "success": True,
-            "schemaVersion": "foggy-deepseek-datasource-run/v1",
-            "profile": profile,
-            "phaseStatus": "awaiting-bind-approval",
-            "evidenceDir": str(evidence_dir),
-            "evidenceFiles": files,
-            "next": "rerun with --approve-configure --approve-bind after namespace binding is approved",
-            "productionReady": False,
-        }
+    if step_completed(state, "datasourceConfigured"):
+        configured = resumed_phase(profile, "datasourceConfigured")
+        save_composite_result(evidence_dir, "02-datasource-dry.json", configured, files)
+        save_composite_result(evidence_dir, "03-datasource-apply.json", configured, files)
+    else:
+        configure_dry = datasource_configure_command(argparse.Namespace(
+            install_root=args.install_root, data_root=args.data_root, profile=profile, apply=False, replace=False,
+        ))
+        save_composite_result(evidence_dir, "02-datasource-dry.json", configure_dry, files)
+        if not args.approve_configure:
+            return {
+                "success": True,
+                "schemaVersion": "foggy-deepseek-datasource-run/v1",
+                "profile": profile,
+                "phaseStatus": "awaiting-configure-approval",
+                "evidenceDir": str(evidence_dir),
+                "evidenceFiles": files,
+                "next": "rerun with --approve-configure after the datasource mutation is approved",
+                "productionReady": False,
+            }
+        configured = datasource_configure_command(argparse.Namespace(
+            install_root=args.install_root, data_root=args.data_root, profile=profile, apply=True, replace=False,
+        ))
+        save_composite_result(evidence_dir, "03-datasource-apply.json", configured, files)
+        state = read_onboarding_state(data_root, profile)
 
-    bound = datasource_verify_command(argparse.Namespace(
-        install_root=args.install_root, data_root=args.data_root, profile=profile, bind=True,
-    ))
-    save_composite_result(evidence_dir, "05-datasource-bind.json", bound, files)
-    discovered = schema_discover_command(argparse.Namespace(
-        install_root=args.install_root,
-        data_root=args.data_root,
-        profile=profile,
-        schema=args.schema,
-        pattern=args.pattern,
-        table=args.table,
-        max_tables=args.max_tables,
-        list_only=False,
-        no_views=args.no_views,
-        include_indexes=args.include_indexes,
-    ))
+    if step_completed(state, "datasourceVerified"):
+        bound = resumed_phase(profile, "datasourceVerified")
+        save_composite_result(evidence_dir, "04-datasource-test.json", bound, files)
+        save_composite_result(evidence_dir, "05-datasource-bind.json", bound, files)
+    else:
+        tested = datasource_verify_command(argparse.Namespace(
+            install_root=args.install_root, data_root=args.data_root, profile=profile, bind=False,
+        ))
+        save_composite_result(evidence_dir, "04-datasource-test.json", tested, files)
+        if not args.approve_bind:
+            return {
+                "success": True,
+                "schemaVersion": "foggy-deepseek-datasource-run/v1",
+                "profile": profile,
+                "phaseStatus": "awaiting-bind-approval",
+                "evidenceDir": str(evidence_dir),
+                "evidenceFiles": files,
+                "next": "rerun with --approve-configure --approve-bind after namespace binding is approved",
+                "productionReady": False,
+            }
+        bound = datasource_verify_command(argparse.Namespace(
+            install_root=args.install_root, data_root=args.data_root, profile=profile, bind=True,
+        ))
+        save_composite_result(evidence_dir, "05-datasource-bind.json", bound, files)
+        state = read_onboarding_state(data_root, profile)
+
+    if step_completed(state, "schemaDiscovered"):
+        schema_step = state["steps"]["schemaDiscovered"]
+        discovered = resumed_phase(
+            profile,
+            "schemaDiscovered",
+            selectedCount=schema_step.get("selectedCount", 0),
+            artifactPath=state.get("artifacts", {}).get("schemaDiscovery"),
+        )
+    else:
+        discovered = schema_discover_command(argparse.Namespace(
+            install_root=args.install_root,
+            data_root=args.data_root,
+            profile=profile,
+            schema=args.schema,
+            pattern=args.pattern,
+            table=args.table,
+            max_tables=args.max_tables,
+            list_only=False,
+            no_views=args.no_views,
+            include_indexes=args.include_indexes,
+        ))
     save_composite_result(evidence_dir, "06-schema.json", discovered, files)
     return {
         "success": True,
@@ -1989,6 +2429,45 @@ def datasource_run_command(args: argparse.Namespace) -> dict:
     }
 
 
+def semantic_plan_snapshot(state: dict, plan: dict, project_root: Path | None = None) -> tuple[Path, dict, bool]:
+    project_root = normalized(project_root or state["projectRoot"])
+    draft_dir = normalized(project_root / plan["draftDir"])
+    if not is_child(draft_dir, project_root) or draft_dir == project_root:
+        raise OnboardingError("draftDir must stay inside projectRoot and cannot equal it")
+    manifest = semantic_manifest(draft_dir)
+    semantic = state.get("semantic", {})
+    registered = semantic.get("draftManifest") or {}
+    matches = bool(
+        step_completed(state, "semanticDrafted")
+        and normalized(semantic.get("draftDir", draft_dir)) == draft_dir
+        and semantic.get("bundleName") == plan["bundleName"]
+        and semantic.get("queryModels") == plan["queryModels"]
+        and registered.get("digest") == manifest["digest"]
+    )
+    return draft_dir, manifest, matches
+
+
+def published_digest_matches(state: dict, digest: str) -> bool:
+    published = state.get("steps", {}).get("semanticPublished", {})
+    return published.get("status") == "completed" and published.get("digest") == digest
+
+
+def workspace_query_verification(state: dict, project_root: Path, query_model: str, digest: str) -> dict | None:
+    requested_root = str(normalized(project_root))
+    candidates = list(state.get("workspaceVerifications", []))
+    legacy = state.get("steps", {}).get("semanticVerified", {})
+    if legacy.get("status") == "completed" and legacy.get("projectRoot"):
+        candidates.append(legacy)
+    for item in candidates:
+        if (
+            item.get("projectRoot") == requested_root
+            and item.get("queryModel") == query_model
+            and item.get("queryPayloadDigest") == digest
+        ):
+            return item
+    return None
+
+
 def semantic_run_command(args: argparse.Namespace) -> dict:
     approved_plan = validate_semantic_plan(read_json_object(normalized(args.semantic_plan), "Semantic plan"))
     if not approved_plan.get("profile"):
@@ -1999,7 +2478,22 @@ def semantic_run_command(args: argparse.Namespace) -> dict:
     profile_args = argparse.Namespace(**vars(args))
     profile_args.profile = profile
     state, _install_state, _data_root, _runtime_state = require_profile(profile_args, require_runtime=True)
-    project_root = normalized(state["projectRoot"])
+    project_root = normalized(getattr(args, "project_root", None) or state["projectRoot"])
+    if not project_root_is_bound(state, project_root):
+        raise OnboardingError(
+            "Current projectRoot is not bound to this completed profile; run onboard-datasource-run from this workspace first"
+        )
+    payload_path = normalized(args.query_payload)
+    if not is_child(payload_path, project_root):
+        raise OnboardingError(
+            "Query payload must stay inside projectRoot; place contracts under .foggy/onboarding-contracts before approval"
+        )
+    bounded_query_payload(payload_path)
+    declared_query_model = args.query_model or (approved_plan["queryModels"][0] if len(approved_plan["queryModels"]) == 1 else None)
+    if not declared_query_model:
+        raise OnboardingError("--query-model is required when the semantic plan declares multiple query models")
+    if declared_query_model not in approved_plan["queryModels"]:
+        raise OnboardingError("--query-model must be declared in semanticPlan.queryModels")
     contract_evidence = approved_plan.get("evidenceDir")
     if contract_evidence and args.evidence_dir:
         if normalized(project_root / contract_evidence) != normalized(args.evidence_dir):
@@ -2007,79 +2501,144 @@ def semantic_run_command(args: argparse.Namespace) -> dict:
     evidence_dir = composite_evidence_dir(project_root, profile, str(project_root / contract_evidence) if contract_evidence else args.evidence_dir)
     files: list[str] = []
 
-    drafted = semantic_draft_command(argparse.Namespace(
-        install_root=args.install_root,
-        data_root=args.data_root,
-        profile=profile,
-        semantic_plan=args.semantic_plan,
-    ))
+    _draft_dir, manifest, draft_matches = semantic_plan_snapshot(state, approved_plan, project_root)
+    published_matches = published_digest_matches(state, manifest["digest"])
+    if normalized(state["projectRoot"]) != project_root and not published_matches:
+        raise OnboardingError(
+            "A secondary workspace may reuse an identical published semantic layer but cannot replace it; "
+            "publish changes from the original projectRoot or choose a new profile"
+        )
+    if draft_matches or published_matches:
+        drafted = resumed_phase(profile, "semanticDrafted", digest=manifest["digest"])
+    else:
+        drafted = semantic_draft_command(argparse.Namespace(
+            install_root=args.install_root,
+            data_root=args.data_root,
+            profile=profile,
+            semantic_plan=args.semantic_plan,
+        ))
+        state = read_onboarding_state(normalized(state["dataRoot"]), profile)
+        manifest = state["semantic"]["draftManifest"]
     save_composite_result(evidence_dir, "07-semantic-draft.json", drafted, files)
-    validate_dry = semantic_validate_command(argparse.Namespace(
-        install_root=args.install_root,
-        data_root=args.data_root,
-        profile=profile,
-        apply=False,
-        include_stack_trace=False,
-    ))
-    save_composite_result(evidence_dir, "08-semantic-validate-dry.json", validate_dry, files)
-    if not args.approve_validate:
-        return {
-            "success": True,
-            "schemaVersion": "foggy-deepseek-semantic-run/v1",
-            "profile": profile,
-            "phaseStatus": "awaiting-validate-approval",
-            "evidenceDir": str(evidence_dir),
-            "evidenceFiles": files,
-            "next": "rerun with --approve-validate after the validation catalog mutation is approved",
-            "productionReady": False,
-        }
-
-    validated = semantic_validate_command(argparse.Namespace(
-        install_root=args.install_root,
-        data_root=args.data_root,
-        profile=profile,
-        apply=True,
-        include_stack_trace=False,
-    ))
+    state = read_onboarding_state(normalized(state["dataRoot"]), profile)
+    validation_step = state.get("steps", {}).get("semanticValidated", {})
+    published_matches = published_digest_matches(state, manifest["digest"])
+    validation_matches = validation_step.get("status") == "completed" and validation_step.get("digest") == manifest["digest"]
+    if validation_matches or published_matches:
+        if published_matches and not validation_matches:
+            mark_step(state, "semanticValidated", "completed", digest=manifest["digest"], resumedFromPublished=True)
+            write_onboarding_state(normalized(state["dataRoot"]), state)
+        validated = resumed_phase(profile, "semanticValidated", digest=manifest["digest"])
+        save_composite_result(evidence_dir, "08-semantic-validate-dry.json", validated, files)
+    else:
+        validate_dry = semantic_validate_command(argparse.Namespace(
+            install_root=args.install_root,
+            data_root=args.data_root,
+            profile=profile,
+            apply=False,
+            include_stack_trace=False,
+        ))
+        save_composite_result(evidence_dir, "08-semantic-validate-dry.json", validate_dry, files)
+        if not args.approve_validate:
+            return {
+                "success": True,
+                "schemaVersion": "foggy-deepseek-semantic-run/v1",
+                "profile": profile,
+                "phaseStatus": "awaiting-validate-approval",
+                "evidenceDir": str(evidence_dir),
+                "evidenceFiles": files,
+                "next": "rerun with --approve-validate after the validation catalog mutation is approved",
+                "productionReady": False,
+            }
+        validated = semantic_validate_command(argparse.Namespace(
+            install_root=args.install_root,
+            data_root=args.data_root,
+            profile=profile,
+            apply=True,
+            include_stack_trace=False,
+        ))
     save_composite_result(evidence_dir, "09-semantic-validate-apply.json", validated, files)
-    publish_dry = semantic_publish_command(argparse.Namespace(
-        install_root=args.install_root,
-        data_root=args.data_root,
-        profile=profile,
-        apply=False,
-        replace_bundle=False,
-        watch=False,
-        prune=False,
-    ))
-    save_composite_result(evidence_dir, "10-semantic-publish-dry.json", publish_dry, files)
-    if not args.approve_publish:
+    state = read_onboarding_state(normalized(state["dataRoot"]), profile)
+    if published_digest_matches(state, manifest["digest"]):
+        published = resumed_phase(
+            profile,
+            "semanticPublished",
+            digest=manifest["digest"],
+            bundleName=state["semantic"]["bundleName"],
+        )
+        save_composite_result(evidence_dir, "10-semantic-publish-dry.json", published, files)
+    else:
+        publish_dry = semantic_publish_command(argparse.Namespace(
+            install_root=args.install_root,
+            data_root=args.data_root,
+            profile=profile,
+            apply=False,
+            replace_bundle=False,
+            watch=False,
+            prune=False,
+        ))
+        save_composite_result(evidence_dir, "10-semantic-publish-dry.json", publish_dry, files)
+        if not args.approve_publish:
+            return {
+                "success": True,
+                "schemaVersion": "foggy-deepseek-semantic-run/v1",
+                "profile": profile,
+                "phaseStatus": "awaiting-publish-approval",
+                "evidenceDir": str(evidence_dir),
+                "evidenceFiles": files,
+                "next": "rerun with --approve-validate --approve-publish after publication is approved",
+                "productionReady": False,
+            }
+        published = semantic_publish_command(argparse.Namespace(
+            install_root=args.install_root,
+            data_root=args.data_root,
+            profile=profile,
+            apply=True,
+            replace_bundle=False,
+            watch=False,
+            prune=False,
+        ))
+    save_composite_result(evidence_dir, "11-semantic-publish-apply.json", published, files)
+    state = read_onboarding_state(normalized(state["dataRoot"]), profile)
+    payload_digest = sha256(payload_path)
+    verified_step = workspace_query_verification(state, project_root, declared_query_model, payload_digest)
+    if verified_step:
+        resumed = resumed_phase(
+            profile,
+            "semanticVerified",
+            queryModel=declared_query_model,
+            queryValidated=True,
+            queryExecuted=True,
+            rowCount=verified_step.get("rowCount"),
+            queryPayloadDigest=payload_digest,
+        )
+        save_composite_result(evidence_dir, "12-query-validate.json", resumed, files)
+        save_composite_result(evidence_dir, "13-query-execute.json", resumed, files)
+        status = onboarding_status_command(argparse.Namespace(
+            install_root=args.install_root, data_root=args.data_root, profile=profile,
+        ))
+        save_composite_result(evidence_dir, "14-status.json", status, files)
         return {
             "success": True,
             "schemaVersion": "foggy-deepseek-semantic-run/v1",
             "profile": profile,
-            "phaseStatus": "awaiting-publish-approval",
+            "phaseStatus": "completed",
+            "resumed": True,
+            "queryModel": declared_query_model,
+            "queryValidated": True,
+            "queryExecuted": True,
+            "rowCount": verified_step.get("rowCount"),
             "evidenceDir": str(evidence_dir),
             "evidenceFiles": files,
-            "next": "rerun with --approve-validate --approve-publish after publication is approved",
             "productionReady": False,
         }
-
-    published = semantic_publish_command(argparse.Namespace(
-        install_root=args.install_root,
-        data_root=args.data_root,
-        profile=profile,
-        apply=True,
-        replace_bundle=False,
-        watch=False,
-        prune=False,
-    ))
-    save_composite_result(evidence_dir, "11-semantic-publish-apply.json", published, files)
     query_validated = semantic_verify_command(argparse.Namespace(
         install_root=args.install_root,
         data_root=args.data_root,
         profile=profile,
-        query_model=args.query_model,
+        query_model=declared_query_model,
         query_payload=args.query_payload,
+        project_root=str(project_root),
         execute=False,
     ))
     save_composite_result(evidence_dir, "12-query-validate.json", query_validated, files)
@@ -2101,8 +2660,9 @@ def semantic_run_command(args: argparse.Namespace) -> dict:
         install_root=args.install_root,
         data_root=args.data_root,
         profile=profile,
-        query_model=args.query_model,
+        query_model=declared_query_model,
         query_payload=args.query_payload,
+        project_root=str(project_root),
         execute=True,
     ))
     save_composite_result(evidence_dir, "13-query-execute.json", executed, files)
@@ -2237,6 +2797,7 @@ def build_parser() -> argparse.ArgumentParser:
     install.add_argument("--project-root")
     install.add_argument("--asset-cache-dir", action="append", default=[])
     install.add_argument("--replace-skill", action="store_true")
+    install.add_argument("--repair-component", choices=("cli", "launcher", "analysis-skill"))
     install.add_argument("--skip-cli-install", action="store_true")
     install.add_argument("--cli-command")
     install.add_argument("--progress-file")
@@ -2280,15 +2841,31 @@ def build_parser() -> argparse.ArgumentParser:
     status = sub.add_parser("onboard-status")
     status.add_argument("--install-root")
     status.add_argument("--data-root")
-    status.add_argument("--profile", default="default")
+    status.add_argument("--profile")
     status.set_defaults(handler=onboarding_status_command)
 
     resume = sub.add_parser("onboard-resume")
     resume.add_argument("--install-root")
     resume.add_argument("--data-root")
-    resume.add_argument("--profile", default="default")
+    resume.add_argument("--profile")
     resume.set_defaults(handler=onboarding_resume_command)
 
+    onboarding_list = sub.add_parser("onboard-list")
+    onboarding_list.add_argument("--install-root")
+    onboarding_list.add_argument("--data-root")
+    onboarding_list.set_defaults(handler=onboarding_list_command)
+
+    migration_status = sub.add_parser("profile-migration-status")
+    migration_status.add_argument("--install-root")
+    migration_status.add_argument("--data-root")
+    migration_status.set_defaults(handler=profile_migration_status_command)
+
+    migrate = sub.add_parser("profile-migrate")
+    migrate.add_argument("--install-root")
+    migrate.add_argument("--data-root")
+    migrate.add_argument("--approve", action="store_true")
+    migrate.set_defaults(handler=profile_migrate_command)
+
     datasource_run = sub.add_parser("onboard-datasource-run")
     datasource_run.add_argument("--install-root")
     datasource_run.add_argument("--data-root")
@@ -2309,6 +2886,7 @@ def build_parser() -> argparse.ArgumentParser:
     semantic_run = sub.add_parser("onboard-semantic-run")
     semantic_run.add_argument("--install-root")
     semantic_run.add_argument("--data-root")
+    semantic_run.add_argument("--project-root")
     semantic_run.add_argument("--profile")
     semantic_run.add_argument("--semantic-plan", required=True)
     semantic_run.add_argument("--query-payload", required=True)
@@ -2322,7 +2900,7 @@ def build_parser() -> argparse.ArgumentParser:
     datasource_configure = sub.add_parser("datasource-configure")
     datasource_configure.add_argument("--install-root")
     datasource_configure.add_argument("--data-root")
-    datasource_configure.add_argument("--profile", default="default")
+    datasource_configure.add_argument("--profile")
     datasource_configure.add_argument("--apply", action="store_true")
     datasource_configure.add_argument("--replace", action="store_true")
     datasource_configure.set_defaults(handler=datasource_configure_command)
@@ -2330,14 +2908,14 @@ def build_parser() -> argparse.ArgumentParser:
     datasource_verify = sub.add_parser("datasource-verify")
     datasource_verify.add_argument("--install-root")
     datasource_verify.add_argument("--data-root")
-    datasource_verify.add_argument("--profile", default="default")
+    datasource_verify.add_argument("--profile")
     datasource_verify.add_argument("--bind", action="store_true")
     datasource_verify.set_defaults(handler=datasource_verify_command)
 
     schema_discover = sub.add_parser("schema-discover")
     schema_discover.add_argument("--install-root")
     schema_discover.add_argument("--data-root")
-    schema_discover.add_argument("--profile", default="default")
+    schema_discover.add_argument("--profile")
     schema_discover.add_argument("--schema", action="append")
     schema_discover.add_argument("--pattern")
     schema_discover.add_argument("--table", action="append")
@@ -2350,14 +2928,14 @@ def build_parser() -> argparse.ArgumentParser:
     semantic_draft = sub.add_parser("semantic-draft")
     semantic_draft.add_argument("--install-root")
     semantic_draft.add_argument("--data-root")
-    semantic_draft.add_argument("--profile", default="default")
+    semantic_draft.add_argument("--profile")
     semantic_draft.add_argument("--semantic-plan", required=True)
     semantic_draft.set_defaults(handler=semantic_draft_command)
 
     semantic_validate = sub.add_parser("semantic-validate")
     semantic_validate.add_argument("--install-root")
     semantic_validate.add_argument("--data-root")
-    semantic_validate.add_argument("--profile", default="default")
+    semantic_validate.add_argument("--profile")
     semantic_validate.add_argument("--apply", action="store_true")
     semantic_validate.add_argument("--include-stack-trace", action="store_true")
     semantic_validate.set_defaults(handler=semantic_validate_command)
@@ -2365,7 +2943,7 @@ def build_parser() -> argparse.ArgumentParser:
     semantic_publish = sub.add_parser("semantic-publish")
     semantic_publish.add_argument("--install-root")
     semantic_publish.add_argument("--data-root")
-    semantic_publish.add_argument("--profile", default="default")
+    semantic_publish.add_argument("--profile")
     semantic_publish.add_argument("--apply", action="store_true")
     semantic_publish.add_argument("--replace-bundle", action="store_true")
     semantic_publish.add_argument("--watch", action="store_true")
@@ -2375,7 +2953,8 @@ def build_parser() -> argparse.ArgumentParser:
     semantic_verify = sub.add_parser("semantic-verify")
     semantic_verify.add_argument("--install-root")
     semantic_verify.add_argument("--data-root")
-    semantic_verify.add_argument("--profile", default="default")
+    semantic_verify.add_argument("--project-root")
+    semantic_verify.add_argument("--profile")
     semantic_verify.add_argument("--query-model")
     semantic_verify.add_argument("--query-payload", required=True)
     semantic_verify.add_argument("--execute", action="store_true")