@foggy-projects/deepseek-harness-plugin 0.4.0-rc.1 → 0.4.0-rc.2

package/README.md

@@ -14,7 +14,7 @@ modify `PATH`, or register Python globally. Advanced users may explicitly set
 ## Local beta installation
 
 ```powershell
-dsh plugin --profile web add --workspace-root ./foggy-projects-deepseek-harness-plugin-0.4.0-rc.1.tgz
+dsh plugin --profile web add --workspace-root ./foggy-projects-deepseek-harness-plugin-0.4.0-rc.2.tgz
 ```
 
 Restart `dsh web`, use the browser it opens (or the complete printed URL,

package/docs/PUBLIC-BETA-READINESS.md

@@ -1,10 +1,10 @@
-# Public beta readiness: 0.4.0-rc.1
+# Public beta readiness: 0.4.0-rc.2
 
 Assessment date: 2026-09-05
 
 ## Verdict
 
-`0.4.0-rc.1` is suitable for a scoped public beta on Windows 10/11 x64 and
+`0.4.0-rc.2` is suitable for a scoped public beta on Windows 10/11 x64 and
 Linux/WSL2 x64. It is not a general-availability release.
 
 The plugin package stays small and downloads large components only during
@@ -31,7 +31,7 @@ system PATH, registry, or a user's existing Python installation.
   Runtime. The password is excluded from onboarding state and evidence, and
   datasource setup does not trigger Runtime restart. Opaque profiles remain an
   optional advanced path.
-- A real Launcher 0.1.20 smoke on Java 17 accepted a synthetic inline-password
+- A real Launcher 0.1.21 smoke on Java 17 accepted a synthetic inline-password
   datasource through the public Runtime API while retaining the same Java PID.
   The isolated registry confirmed the documented local-development plaintext
   persistence boundary; the test datasource was then removed and the temporary
@@ -41,8 +41,8 @@ system PATH, registry, or a user's existing Python installation.
   PID, while the persisted onboarding state and command evidence contained no
   copy of the synthetic password.
 - The package and settings contract report Python 3.12.13 as `Foggy private`,
-  CLI 0.1.23, Launcher 0.1.20, analysis Skill 0.1.17, and onboarding Skill
-  0.4.0-rc.1; the same component display was accepted in the preceding
+  CLI 0.1.23, Launcher 0.1.21, analysis/query Skills 0.1.18, and onboarding Skill
+  0.4.0-rc.2; the same component display was accepted in the preceding
   native Windows beta run.
 - Runtime startup now reports the current phase, elapsed/timeout seconds, and a
   bounded progress value. A real Windows launch with Temurin 17 reached readiness
@@ -67,7 +67,7 @@ system PATH, registry, or a user's existing Python installation.
   new datasource tests cover secret-free persisted state, direct Runtime API
   submission, CLI bypass for inline development credentials, stable inline
   credential resumption, bounded transient connection retry, and output redaction.
-- A real Java 17 / Launcher 0.1.20 regression resumed the same completed inline
+- A real Java 17 / Launcher 0.1.21 regression resumed the same completed inline
   datasource composite twice, retained the Runtime PID, and emitted a complete
   `01` through `06` workspace evidence sequence without falling back to granular
   commands.

package/docs/RELEASE-CANDIDATE-0.4.0-RC.2.md

@@ -0,0 +1,38 @@
+# Foggy DeepSeek Harness plugin 0.4.0-rc.2 release candidate
+
+Assessment date: 2026-09-06
+
+## Decision
+
+This build is a public preview for Windows 10/11 x64 and Linux/WSL2 x64. It
+remains a development and evaluation plugin; the bundled Runtime defaults are
+not a production security profile.
+
+No Java engine or `foggy-runtime-cli` source was changed for this candidate.
+The plugin consumes the independently accepted CLI 0.1.23, Runtime Launcher
+0.1.21, foggy-ai-analysis Skill 0.1.18, and foggy-semantic-query Skill 0.1.18
+public releases.
+
+## Delta from rc.1
+
+- Upgrade Runtime Launcher from 0.1.20 to 0.1.21.
+- Upgrade foggy-ai-analysis from 0.1.17 to 0.1.18.
+- Install and register foggy-semantic-query 0.1.18 as a second managed Skill.
+- Keep DeepSeek Harness 0.1.2-rc.1, managed Python 3.12.13, CLI 0.1.23, and the
+  default Runtime port 18166 unchanged.
+
+The new public assets and their nested Skill manifests were independently
+checksum-verified. Runtime acceptance covered automatic static-dictionary
+captions, label-to-code filtering, dictionary member enumeration, self-date
+dimensions, and the `$year`, `$month`, and `$yearMonth` describe/query path.
+
+## Publication gate
+
+The plugin's existing automated tests and npm tarball inspection must pass.
+The Runtime functional matrix is not repeated because the exact public
+Launcher and Skill assets were accepted independently before this pin update.
+
+DeepSeek Harness minimum-release-age policy can reject a recently published
+version still present in a profile lockfile. Users should inspect and rebuild
+the profile lockfile or wait for the policy window rather than weakening
+plugin integrity checks.

package/docs/WINDOWS-BETA-ACCEPTANCE.md

@@ -1,7 +1,7 @@
 # Native Windows Beta acceptance
 
 This runbook validates DeepSeek Harness `0.1.2-rc.1` with Foggy plugin
-`0.4.0-rc.1` on a clean 64-bit Windows 10 or Windows 11 machine. Use a local
+`0.4.0-rc.2` on a clean 64-bit Windows 10 or Windows 11 machine. Use a local
 directory that is not synchronized by OneDrive.
 
 ## Prerequisites
@@ -60,9 +60,9 @@ Expected component state:
 
 - Python 3.12.13, source `Foggy private`;
 - CLI 0.1.23;
-- Launcher 0.1.20;
-- analysis Skill 0.1.17;
-- onboarding Skill 0.4.0-rc.1;
+- Launcher 0.1.21;
+- analysis/query Skills 0.1.18;
+- onboarding Skill 0.4.0-rc.2;
 - Java 17+ available;
 - native DSH Skill registration available.
 

package/lib/client.js

@@ -35,7 +35,7 @@ window.__ModuleLoader__.load({
       package: '@foggy-projects/deepseek-harness-plugin',
       descriptors: [
         ...[
-        'status', 'plan', 'initialize', 'repair', 'repairPython', 'repairCli', 'repairLauncher', 'repairAnalysisSkill',
+        'status', 'plan', 'initialize', 'repair', 'repairPython', 'repairCli', 'repairLauncher', 'repairAnalysisSkill', 'repairSemanticQuerySkill',
         'migrateProfiles', 'diagnostics', 'runtimeStart', 'runtimeStop',
         ].map((method) => descriptor(method)),
         descriptor('saveRuntimeSettings', [{
@@ -66,6 +66,7 @@ window.__ModuleLoader__.load({
       cli: 'CLI',
       launcher: 'Launcher',
       analysisSkill: '分析 Skill',
+      semanticQuerySkill: '语义查询 Skill',
       onboardingSkill: '引导 Skill',
       skillRegistry: 'DSH Skill 注册',
       python: 'Python',
@@ -81,6 +82,7 @@ window.__ModuleLoader__.load({
       repairCli: '检查 / 修复 CLI',
       repairLauncher: '检查 / 修复 Launcher',
       repairAnalysisSkill: '检查 / 修复分析 Skill',
+      repairSemanticQuerySkill: '检查 / 修复语义查询 Skill',
       diagnostics: '导出诊断报告',
       diagnosticsSaved: '诊断报告已保存',
       start: '启动 Runtime',
@@ -92,6 +94,7 @@ window.__ModuleLoader__.load({
       progressCli: '准备 CLI',
       progressLauncher: '准备 Launcher',
       progressAnalysis: '准备分析 Skill',
+      progressSemanticQuery: '准备语义查询 Skill',
       progressSkills: '注册 DSH Skills',
       progressState: '写入安装状态',
       progressComplete: '初始化完成',
@@ -169,6 +172,7 @@ window.__ModuleLoader__.load({
       cli: 'CLI',
       launcher: 'Launcher',
       analysisSkill: 'Analysis Skill',
+      semanticQuerySkill: 'Semantic Query Skill',
       onboardingSkill: 'Onboarding Skill',
       skillRegistry: 'DSH Skill registry',
       python: 'Python',
@@ -184,6 +188,7 @@ window.__ModuleLoader__.load({
       repairCli: 'Check / repair CLI',
       repairLauncher: 'Check / repair Launcher',
       repairAnalysisSkill: 'Check / repair analysis Skill',
+      repairSemanticQuerySkill: 'Check / repair semantic query Skill',
       diagnostics: 'Export diagnostics',
       diagnosticsSaved: 'Diagnostics saved',
       start: 'Start Runtime',
@@ -195,6 +200,7 @@ window.__ModuleLoader__.load({
       progressCli: 'Preparing CLI',
       progressLauncher: 'Preparing Launcher',
       progressAnalysis: 'Preparing analysis Skill',
+      progressSemanticQuery: 'Preparing semantic query Skill',
       progressSkills: 'Registering DSH Skills',
       progressState: 'Writing install state',
       progressComplete: 'Initialization complete',
@@ -324,6 +330,7 @@ window.__ModuleLoader__.load({
         cli: 'progressCli',
         launcher: 'progressLauncher',
         'analysis-skill': 'progressAnalysis',
+        'semantic-query-skill': 'progressSemanticQuery',
         'workspace-skills': 'progressSkills',
         state: 'progressState',
         complete: 'progressComplete',
@@ -603,6 +610,7 @@ window.__ModuleLoader__.load({
           componentCard(t('cli'), status.components.cli, 'runtime', t),
           componentCard(t('launcher'), status.components.launcher, 'runtime', t),
           componentCard(t('analysisSkill'), status.components.analysisSkill, 'runtime', t),
+          componentCard(t('semanticQuerySkill'), status.components.semanticQuerySkill, 'runtime', t),
           componentCard(t('onboardingSkill'), status.components.onboardingSkill, 'runtime', t),
           componentCard(t('skillRegistry'), { installed: status.components.onboardingSkill?.provider === 'foggy-managed-skills', version: 'native' }, 'runtime', t),
         ] }),
@@ -613,6 +621,7 @@ window.__ModuleLoader__.load({
             jsx('button', { className: 'foggy-button', type: 'button', disabled: busy, onClick: () => run('repairCli'), children: t('repairCli') }),
             jsx('button', { className: 'foggy-button', type: 'button', disabled: busy, onClick: () => run('repairLauncher'), children: t('repairLauncher') }),
             jsx('button', { className: 'foggy-button', type: 'button', disabled: busy, onClick: () => run('repairAnalysisSkill'), children: t('repairAnalysisSkill') }),
+            jsx('button', { className: 'foggy-button', type: 'button', disabled: busy, onClick: () => run('repairSemanticQuerySkill'), children: t('repairSemanticQuerySkill') }),
           ] }),
         ] }),
         status.profileMigration?.pendingCount || status.profileMigration?.conflictCount ? jsxs('div', { className: 'foggy-warning', children: [

package/lib/index.js

@@ -228,8 +228,10 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
     const cliPath = state?.cli?.command
     const launcherPath = state?.launcher?.path
     const analysisSkillPath = state?.skills?.analysis?.path || join(roots.installRoot, 'skills', 'foggy-ai-analysis')
+    const semanticQuerySkillPath = state?.skills?.semanticQuery?.path || join(roots.installRoot, 'skills', 'foggy-semantic-query')
     const onboardingSkillPath = join(packageRoot, 'skills', 'foggy-deepseek-onboarding')
     const analysisMarker = await readOptionalJson(join(analysisSkillPath, '.foggy-managed-skill.json'))
+    const semanticQueryMarker = await readOptionalJson(join(semanticQuerySkillPath, '.foggy-managed-skill.json'))
     const components = {
       python,
       java,
@@ -249,6 +251,14 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
         ),
         version: state?.skills?.analysis?.version ?? manifest.components.analysisSkill.version,
       },
+      semanticQuerySkill: {
+        installed: Boolean(
+          await exists(join(semanticQuerySkillPath, 'SKILL.md'))
+          && semanticQueryMarker?.schemaVersion === 'foggy-managed-skill/v1'
+          && semanticQueryMarker?.componentVersion === manifest.components.semanticQuerySkill.version
+        ),
+        version: state?.skills?.semanticQuery?.version ?? manifest.components.semanticQuerySkill.version,
+      },
       onboardingSkill: {
         installed: await exists(join(onboardingSkillPath, 'SKILL.md')),
         version: manifest.packageVersion,
@@ -259,6 +269,7 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
       && components.cli.installed
       && components.launcher.installed
       && components.analysisSkill.installed
+      && components.semanticQuerySkill.installed
       && components.onboardingSkill.installed
     const running = Boolean(runtime && processRunning(Number(runtime.pid)))
     const activePort = running && Number.isInteger(Number(runtime?.port)) ? Number(runtime.port) : null
@@ -314,8 +325,8 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
         'download and verify a pinned private Python runtime',
         'create isolated Python environment',
         'download and verify pinned CLI and Launcher assets',
-        'install the Foggy analysis Skill into the global managed component directory',
-        'register onboarding and analysis Skills through the native DSH Skill registry',
+        'install the Foggy analysis and semantic-query Skills into the global managed component directory',
+        'register onboarding, analysis, and semantic-query Skills through the native DSH Skill registry',
         'write global install state; resolve each workspace from the DSH session cwd',
       ],
       secretsInDshSettings: false,
@@ -346,6 +357,10 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
     return this.startOperation('repair-analysis-skill', true, ['install', '--repair-component', 'analysis-skill'])
   }
 
+  async repairSemanticQuerySkill() {
+    return this.startOperation('repair-semantic-query-skill', true, ['install', '--repair-component', 'semantic-query-skill'])
+  }
+
   async migrateProfiles() {
     return this.startOperation('profile-migration', false, ['profile-migrate', '--approve'])
   }
@@ -530,7 +545,7 @@ export class FoggyIntegrationGateway extends TypertRemoteService {
 
 const markerInitializers = []
 for (const method of [
-  'status', 'plan', 'initialize', 'repair', 'repairPython', 'repairCli', 'repairLauncher', 'repairAnalysisSkill',
+  'status', 'plan', 'initialize', 'repair', 'repairPython', 'repairCli', 'repairLauncher', 'repairAnalysisSkill', 'repairSemanticQuerySkill',
   'migrateProfiles', 'diagnostics', 'runtimeStart', 'runtimeStop',
   'saveRuntimeSettings',
 ]) {

package/lib/remote-descriptor.js

@@ -28,6 +28,7 @@ export const descriptors = [
   descriptor('initialize'),
   descriptor('repair'),
   descriptor('repairPython'),
+  descriptor('repairSemanticQuerySkill'),
   descriptor('runtimeStart'),
   descriptor('runtimeStop'),
   descriptor('saveRuntimeSettings', [{

package/lib/skill-provider.js

@@ -56,15 +56,15 @@ function candidate(name, description, path, source) {
   }
 }
 
-async function managedAnalysisSkill(installRoot, manifest) {
+async function managedSkill(installRoot, manifest, { stateKey, componentKey, kind }) {
   const state = await readOptionalJson(join(installRoot, 'install-state.json'))
-  const path = state?.skills?.analysis?.path
+  const path = state?.skills?.[stateKey]?.path
   if (!path || !await exists(join(path, 'SKILL.md'))) return null
   const marker = await readOptionalJson(join(path, '.foggy-managed-skill.json'))
   if (
     marker?.schemaVersion !== 'foggy-managed-skill/v1'
-    || marker?.kind !== 'analysis'
-    || marker?.componentVersion !== manifest.components.analysisSkill.version
+    || marker?.kind !== kind
+    || marker?.componentVersion !== manifest.components[componentKey].version
   ) return null
   return join(path, 'SKILL.md')
 }
@@ -83,10 +83,15 @@ export function createFoggySkillProvider({ installRoot, versionsFile }) {
         'bundled',
       )]
       if (!manifest) return result
-      const analysisPath = await managedAnalysisSkill(installRoot, manifest)
-      if (analysisPath) {
-        const analysis = parseSkill(await readFile(analysisPath, 'utf8'), 'foggy-ai-analysis')
-        result.push(candidate('foggy-ai-analysis', analysis.metadata.description, analysisPath, 'bundled'))
+      const managedSkills = [
+        { name: 'foggy-ai-analysis', stateKey: 'analysis', componentKey: 'analysisSkill', kind: 'analysis' },
+        { name: 'foggy-semantic-query', stateKey: 'semanticQuery', componentKey: 'semanticQuerySkill', kind: 'semantic-query' },
+      ]
+      for (const spec of managedSkills) {
+        const path = await managedSkill(installRoot, manifest, spec)
+        if (!path) continue
+        const skill = parseSkill(await readFile(path, 'utf8'), spec.name)
+        result.push(candidate(spec.name, skill.metadata.description, path, 'bundled'))
       }
       return result
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foggy-projects/deepseek-harness-plugin",
-  "version": "0.4.0-rc.1",
+  "version": "0.4.0-rc.2",
   "description": "Foggy Java data analysis engine integration for DeepSeek Harness",
   "type": "module",
   "main": "./lib/index.js",
@@ -20,7 +20,7 @@
     "cordis.patch.yml",
     "experience/linux/**",
     "docs/PUBLIC-BETA-READINESS.md",
-    "docs/RELEASE-CANDIDATE-0.4.0-RC.1.md",
+    "docs/RELEASE-CANDIDATE-0.4.0-RC.2.md",
     "docs/WINDOWS-BETA-ACCEPTANCE.md",
     "THIRD-PARTY-RUNTIME-NOTICES.md",
     "README.md"

package/skills/foggy-deepseek-onboarding/SKILL.md

@@ -65,7 +65,7 @@ are authoritative; do not copy the Skill into the current workspace.
    instead of treating success as proof that every requested option took effect. Free-text advice is
    optional. When a warning indicates possible semantic drift, use `models describe` to prepare a
    corrected payload if the user's intent can be preserved; otherwise disclose the limitation.
-   Runtime 0.1.20 defaults unknown ordinary Query DSL properties to `WARN`; `IGNORE` continues without
+   Runtime 0.1.21 defaults unknown ordinary Query DSL properties to `WARN`; `IGNORE` continues without
    `queryInputWarnings`, while `STRICT` rejects the request with the complete structured violations.
    Never reinterpret a protected or governance-field failure as an ignorable warning.
 7. When the model works, recommend committing the model directory to the user's own Git repository.

package/skills/foggy-deepseek-onboarding/assets/versions.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "foggy-deepseek-onboarding-versions/v1",
-  "packageVersion": "0.4.0-rc.1",
-  "validatedAt": "2026-09-05",
+  "packageVersion": "0.4.0-rc.2",
+  "validatedAt": "2026-09-06",
   "components": {
     "deepseekHarness": {
       "version": "0.1.2-rc.1",
@@ -66,64 +66,89 @@
       }
     },
     "launcher": {
-      "version": "0.1.20",
+      "version": "0.1.21",
       "minimumJavaVersion": "17.0.0",
       "runtimeApiContract": "foggy-runtime-api/v1",
       "assets": [
         {
-          "file": "foggy-runtime-launcher-0.1.20.jar",
-          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.20/foggy-runtime-launcher-0.1.20.jar",
-          "sha256": "5f7742ba2875dcfd8f00deb4a8aaa43147d3fce2315e907e6ce9da4e25eae4b5"
+          "file": "foggy-runtime-launcher-0.1.21.jar",
+          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.21/foggy-runtime-launcher-0.1.21.jar",
+          "sha256": "0b5002e40633f4606b0f5d3adbcd734ad4a11d8204decab162bb53b6ab28b3b3"
         },
         {
           "file": "start-foggy-runtime.ps1",
-          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.20/start-foggy-runtime.ps1",
-          "sha256": "7e001f9dc9c491b85f8a687ca1b094bc5529e76abd536bfaf77aa98ad5bd2867"
+          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.21/start-foggy-runtime.ps1",
+          "sha256": "8609f8c60bad9e56460b132e1bd6c699d4ebf47cf591c3e6bc37bc8563d7de5a"
         },
         {
           "file": "start-foggy-runtime.sh",
-          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.20/start-foggy-runtime.sh",
-          "sha256": "c0f5ff32fb2429d61aa6b3c1ce38dad8d1d32ca35443ad9d3b78b848bea2eeed"
+          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.21/start-foggy-runtime.sh",
+          "sha256": "fa844f422473ba00a31cf801092b0fe4ef93fe8697656a9063e0ec27dacef715"
         },
         {
           "file": "README-foggy-runtime-launcher.md",
-          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.20/README-foggy-runtime-launcher.md",
-          "sha256": "8b48dd3d2b2183b6168779733a195fb89172d39d3b91c17ecfda38f4f496ea72"
+          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.21/README-foggy-runtime-launcher.md",
+          "sha256": "6b63cafe798e19c255a043e15e64109f6fb3252aee3fb9c37ab6a66d9adbf3cf"
         },
         {
           "file": "runtime-launcher-manifest.json",
-          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.20/runtime-launcher-manifest.json",
-          "sha256": "d6a36647952230edd3e57d8d47f481f65c8fcf4b26635c59e973b43f640e7b29"
+          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.21/runtime-launcher-manifest.json",
+          "sha256": "1591804035bbf589912907195c74746bf97edff3b9e6ebd7d569ecc0e5aebed7"
         },
         {
           "file": "SHA256SUMS",
-          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.20/SHA256SUMS",
-          "sha256": "de6aafcad95f002ef5080004ff8b8436ecdc0e69c4dd1b92d1aab25f5e4e073c"
+          "url": "https://github.com/foggy-projects/foggy-data-mcp-bridge/releases/download/foggy-runtime-launcher-v0.1.21/SHA256SUMS",
+          "sha256": "6e03f8861176d73be22c4c7c6f6345a68e49aacfb5375cd5cf2c54f1dc4cbe5d"
         }
       ]
     },
     "analysisSkill": {
       "name": "foggy-ai-analysis",
-      "version": "0.1.17",
-      "minimumCliVersion": "0.1.21",
+      "version": "0.1.18",
+      "minimumCliVersion": "0.1.23",
       "assets": [
         {
           "role": "zip",
-          "file": "foggy-ai-analysis-skill-0.1.17.zip",
-          "url": "https://github.com/foggy-projects/foggy-ai-analysis/releases/download/v0.1.17/foggy-ai-analysis-skill-0.1.17.zip",
-          "sha256": "2c5a10090befc38dd2cf8c3de5121d19c28682ca9c0fe72daf778d315c56c7ff"
+          "file": "foggy-ai-analysis-skill-0.1.18.zip",
+          "url": "https://github.com/foggy-projects/foggy-ai-analysis/releases/download/v0.1.18/foggy-ai-analysis-skill-0.1.18.zip",
+          "sha256": "93d7bb8812e91a7f85040fe14ce40a3e0657cb2fed07ddfeb9c6f28aca9e2925"
         },
         {
           "role": "manifest",
-          "file": "foggy-ai-analysis-skill-0.1.17-manifest.json",
-          "url": "https://github.com/foggy-projects/foggy-ai-analysis/releases/download/v0.1.17/foggy-ai-analysis-skill-0.1.17-manifest.json",
-          "sha256": "094b1401ff384f011ef80446dd639d8afb2585aa01d7a7ba49d39cb2968ae8bf"
+          "file": "foggy-ai-analysis-skill-0.1.18-manifest.json",
+          "url": "https://github.com/foggy-projects/foggy-ai-analysis/releases/download/v0.1.18/foggy-ai-analysis-skill-0.1.18-manifest.json",
+          "sha256": "c6e3ae9d9ab17d8fd05fde9b94bba25577662f7edd862b099429e24244d22739"
         },
         {
           "role": "checksums",
-          "file": "foggy-ai-analysis-skill-0.1.17-SHA256SUMS",
-          "url": "https://github.com/foggy-projects/foggy-ai-analysis/releases/download/v0.1.17/foggy-ai-analysis-skill-0.1.17-SHA256SUMS",
-          "sha256": "18804088cd7da7af6bbf70d658cb0d6a5a31e765470ed673dfd274f1789db240"
+          "file": "foggy-ai-analysis-skill-0.1.18-SHA256SUMS",
+          "url": "https://github.com/foggy-projects/foggy-ai-analysis/releases/download/v0.1.18/foggy-ai-analysis-skill-0.1.18-SHA256SUMS",
+          "sha256": "10b4c97e30201d63fa1fb9773e9a540827b92b495369403deb12b9ab67c69846"
+        }
+      ]
+    },
+    "semanticQuerySkill": {
+      "name": "foggy-semantic-query",
+      "version": "0.1.18",
+      "minimumCliVersion": "0.1.23",
+      "assets": [
+        {
+          "role": "zip",
+          "file": "foggy-semantic-query-skill-0.1.18.zip",
+          "url": "https://github.com/foggy-projects/foggy-ai-analysis/releases/download/v0.1.18/foggy-semantic-query-skill-0.1.18.zip",
+          "sha256": "828aa8517385ea7c4956906834d3bea918f56de6e1d2df7ff0779dc31f7f7fb2"
+        },
+        {
+          "role": "manifest",
+          "file": "foggy-semantic-query-skill-0.1.18-manifest.json",
+          "url": "https://github.com/foggy-projects/foggy-ai-analysis/releases/download/v0.1.18/foggy-semantic-query-skill-0.1.18-manifest.json",
+          "sha256": "0348c0786b72c3ea39a5e091ef494559f2fd48a625bd41796fc1b0f6eba82400"
+        },
+        {
+          "role": "checksums",
+          "file": "foggy-semantic-query-skill-0.1.18-SHA256SUMS",
+          "url": "https://github.com/foggy-projects/foggy-ai-analysis/releases/download/v0.1.18/foggy-semantic-query-skill-0.1.18-SHA256SUMS",
+          "sha256": "9fdba41edcb39e07f199b3347191e025a4ade4b535827842f861ffa42f4da9cc"
         }
       ]
     }

package/skills/foggy-deepseek-onboarding/references/onboarding-workflow.md

@@ -117,7 +117,7 @@ The composite result keeps `success=true` when the Runtime safely continues with
 on free-text remediation alone: compare `path`, `suggestedNextAction`, `safeToAutoRepair`,
 `normalizedFragment`, `docsRef`, and `details.allowedProperties` with the described
 model, correct and revalidate when an equivalent supported query preserves the user's intent, or
-clearly report the degraded interpretation. The wrapper accepts Runtime 0.1.20
+clearly report the degraded interpretation. The wrapper accepts Runtime 0.1.21
 `queryInputWarnings` and legacy `warnings` as separate warning kinds. In `IGNORE`, ordinary unknown
 properties continue without `queryInputWarnings`; in `STRICT`, the Runtime rejects the query with the
 complete violations. Protected and governance fields remain fail-closed in every mode.

package/skills/foggy-deepseek-onboarding/scripts/onboarding.py

@@ -1168,22 +1168,26 @@ def safe_extract(zip_path: Path, destination: Path) -> None:
         archive.extractall(destination)
 
 
-def install_analysis_skill(
+def install_managed_skill(
     zip_path: Path,
     install_root: Path,
     version: str,
     expected_hash: str,
     package_version: str,
     replace: bool,
+    *,
+    skill_name: str,
+    kind: str,
+    display_name: str,
 ) -> dict:
     skills_root = install_root / "skills"
-    destination = skills_root / "foggy-ai-analysis"
+    destination = skills_root / skill_name
     with tempfile.TemporaryDirectory(prefix="foggy-skill-") as temporary:
         extract_root = Path(temporary)
         safe_extract(zip_path, extract_root)
         candidates = list(extract_root.rglob("SKILL.md"))
         if len(candidates) != 1:
-            raise OnboardingError(f"Expected exactly one SKILL.md in analysis Skill archive, found {len(candidates)}")
+            raise OnboardingError(f"Expected exactly one SKILL.md in {display_name} archive, found {len(candidates)}")
         source = candidates[0].parent
         source_digest = skill_tree_digest(source)
         if destination.exists():
@@ -1199,7 +1203,7 @@ def install_analysis_skill(
             if marker_matches:
                 marker = write_skill_marker(
                     destination,
-                    kind="analysis",
+                    kind=kind,
                     package_version=package_version,
                     component_version=version,
                     source_digest=source_digest,
@@ -1207,13 +1211,13 @@ def install_analysis_skill(
                 )
                 return {"path": str(destination), "version": version, "digest": marker["installedDigest"], "managed": True, "action": "kept-matching"}
             if not replace:
-                raise OnboardingError(f"Analysis Skill is missing, modified, or outdated at {destination}; use the plugin Repair action to back it up and restore it")
+                raise OnboardingError(f"{display_name} is missing, modified, or outdated at {destination}; use the plugin Repair action to back it up and restore it")
             backup_skill(destination, install_root / "skill-backups")
         skills_root.mkdir(parents=True, exist_ok=True)
         shutil.copytree(source, destination)
     marker = write_skill_marker(
         destination,
-        kind="analysis",
+        kind=kind,
         package_version=package_version,
         component_version=version,
         source_digest=source_digest,
@@ -1264,7 +1268,7 @@ def install_command(args: argparse.Namespace) -> dict:
         "workspaceMode": "dsh-session-cwd",
         "versions": {name: value.get("version") for name, value in components.items()},
         "repairComponent": repair_component,
-        "operations": ["verify private Python", "install isolated CLI", "verify Launcher assets", "install global analysis Skill", "write install state"],
+        "operations": ["verify private Python", "install isolated CLI", "verify Launcher assets", "install global analysis/query Skills", "write install state"],
         "productionReady": False,
     }
     if args.dry_run:
@@ -1364,32 +1368,41 @@ def install_command(args: argparse.Namespace) -> dict:
         (launcher_dir / "start-foggy-runtime.sh").chmod(0o755)
     progress.update("launcher", 3, "Launcher ready", fraction=1.0)
 
-    analysis_assets = components["analysisSkill"]["assets"]
-    for index, asset in enumerate(analysis_assets):
-        progress.update(
-            "analysis-skill", 4, "Downloading and verifying analysis Skill",
-            fraction=index / len(analysis_assets), current_file=asset["file"],
-            completed_files=index, total_files=len(analysis_assets),
-        )
-        verified.append(materialize(
-            asset, downloads / "skill" / asset["file"], cache_dirs,
-            progress=progress, progress_phase="analysis-skill", progress_step=4,
-            progress_index=index, progress_total=len(analysis_assets),
-            progress_message="Downloading and verifying analysis Skill",
-            replace_corrupt=repair_component == "analysis-skill",
-        ))
-        progress.update(
-            "analysis-skill", 4, "Downloading and verifying analysis Skill",
-            fraction=(index + 1) / len(analysis_assets), current_file=asset["file"],
-            completed_files=index + 1, total_files=len(analysis_assets),
-        )
-    zip_asset = next(item for item in analysis_assets if item["role"] == "zip")
-    progress.update("analysis-skill", 4, "Installing analysis Skill", fraction=0.9, current_file=zip_asset["file"])
-    analysis_skill = install_analysis_skill(
-        downloads / "skill" / zip_asset["file"], install_root, components["analysisSkill"]["version"],
-        zip_asset["sha256"], versions["packageVersion"], args.replace_skill or repair_component == "analysis-skill",
+    installed_skills = {}
+    skill_specs = (
+        ("analysisSkill", "analysis", "foggy-ai-analysis", "Analysis Skill", "analysis-skill"),
+        ("semanticQuerySkill", "semantic-query", "foggy-semantic-query", "Semantic Query Skill", "semantic-query-skill"),
     )
-    progress.update("analysis-skill", 4, "Analysis Skill ready", fraction=1.0)
+    for component_key, state_key, skill_name, display_name, repair_key in skill_specs:
+        skill_assets = components[component_key]["assets"]
+        for index, asset in enumerate(skill_assets):
+            progress.update(
+                repair_key, 4, f"Downloading and verifying {display_name}",
+                fraction=index / len(skill_assets), current_file=asset["file"],
+                completed_files=index, total_files=len(skill_assets),
+            )
+            verified.append(materialize(
+                asset, downloads / "skill" / asset["file"], cache_dirs,
+                progress=progress, progress_phase=repair_key, progress_step=4,
+                progress_index=index, progress_total=len(skill_assets),
+                progress_message=f"Downloading and verifying {display_name}",
+                replace_corrupt=repair_component == repair_key,
+            ))
+            progress.update(
+                repair_key, 4, f"Downloading and verifying {display_name}",
+                fraction=(index + 1) / len(skill_assets), current_file=asset["file"],
+                completed_files=index + 1, total_files=len(skill_assets),
+            )
+        zip_asset = next(item for item in skill_assets if item["role"] == "zip")
+        progress.update(repair_key, 4, f"Installing {display_name}", fraction=0.9, current_file=zip_asset["file"])
+        installed_skills[state_key] = install_managed_skill(
+            downloads / "skill" / zip_asset["file"], install_root, components[component_key]["version"],
+            zip_asset["sha256"], versions["packageVersion"], args.replace_skill or repair_component == repair_key,
+            skill_name=skill_name, kind=state_key, display_name=display_name,
+        )
+        progress.update(repair_key, 4, f"{display_name} ready", fraction=1.0)
+    analysis_skill = installed_skills["analysis"]
+    semantic_query_skill = installed_skills["semantic-query"]
     progress.update("workspace-skills", 5, "Registering native DSH Skills", fraction=0.1)
     onboarding_skill = {
         "path": str(skill_root()),
@@ -1414,7 +1427,7 @@ def install_command(args: argparse.Namespace) -> dict:
         },
         "cli": {"version": cli_component["version"], "command": str(cli_command), "mode": cli_mode},
         "launcher": {"version": components["launcher"]["version"], "path": str(launcher_dir)},
-        "skills": {"onboarding": onboarding_skill, "analysis": analysis_skill},
+        "skills": {"onboarding": onboarding_skill, "analysis": analysis_skill, "semanticQuery": semantic_query_skill},
         "verifiedAssets": verified,
         "securityMode": versions["defaults"]["securityMode"],
         "productionReady": False,
@@ -1433,6 +1446,7 @@ def install_command(args: argparse.Namespace) -> dict:
         "cliVersion": cli_component["version"],
         "launcherVersion": components["launcher"]["version"],
         "analysisSkill": analysis_skill,
+        "semanticQuerySkill": semantic_query_skill,
         "onboardingSkill": onboarding_skill,
         "java": java_probe(),
         "next": "run doctor, then runtime-start",
@@ -3324,8 +3338,10 @@ def doctor_command(args: argparse.Namespace) -> dict:
             launcher_checks.append({"file": asset["file"], "present": path.is_file(), "sha256Valid": path.is_file() and sha256(path) == asset["sha256"]})
     launcher_ok = bool(launcher_checks) and all(item["present"] and item["sha256Valid"] for item in launcher_checks)
     analysis_skill_root = normalized(state.get("skills", {}).get("analysis", {}).get("path") or install_root / "skills" / "foggy-ai-analysis") if state else install_root / "skills" / "foggy-ai-analysis"
+    semantic_query_skill_root = normalized(state.get("skills", {}).get("semanticQuery", {}).get("path") or install_root / "skills" / "foggy-semantic-query") if state else install_root / "skills" / "foggy-semantic-query"
     onboarding_skill_root = skill_root()
     analysis_skill = managed_skill_status(analysis_skill_root, "analysis", versions["components"]["analysisSkill"]["version"])
+    semantic_query_skill = managed_skill_status(semantic_query_skill_root, "semantic-query", versions["components"]["semanticQuerySkill"]["version"])
     onboarding_skill = {
         "path": str(onboarding_skill_root),
         "present": (onboarding_skill_root / "SKILL.md").is_file(),
@@ -3348,6 +3364,7 @@ def doctor_command(args: argparse.Namespace) -> dict:
         "cli": cli_ok,
         "launcher": launcher_ok,
         "analysisSkill": analysis_skill["valid"],
+        "semanticQuerySkill": semantic_query_skill["valid"],
         "onboardingSkill": onboarding_skill["valid"],
     }
     if args.strict_runtime:
@@ -3362,7 +3379,7 @@ def doctor_command(args: argparse.Namespace) -> dict:
         "java": java,
         "cli": cli,
         "launcherAssets": launcher_checks,
-        "skills": {"analysis": analysis_skill, "onboarding": onboarding_skill},
+        "skills": {"analysis": analysis_skill, "semanticQuery": semantic_query_skill, "onboarding": onboarding_skill},
         "workspace": {"path": str(project_root), "mode": "dsh-session-cwd"},
         "runtime": runtime,
         "environmentPresence": {name: bool(os.environ.get(name)) for name in ("DEEPSEEK_API_KEY", "ALIYUN_TOKEN_PLAN_API_KEY", "FOGGY_RUNTIME_API_AUTH_CODE", "FOGGY_RUNTIME_AUTHORIZATION")},
@@ -3380,7 +3397,7 @@ def uninstall_command(args: argparse.Namespace) -> dict:
     if install_root == data_root:
         raise OnboardingError("Install root and data root must be different")
     skills_root = install_root / "skills"
-    skill_targets = [skills_root / "foggy-ai-analysis"]
+    skill_targets = [skills_root / "foggy-ai-analysis", skills_root / "foggy-semantic-query"]
     plan = {"installRoot": str(install_root), "dataRoot": str(data_root), "removeSkills": args.remove_skills, "purgeData": args.purge_data}
     if args.dry_run:
         return {"success": True, "dryRun": True, "plan": plan}
@@ -3415,7 +3432,7 @@ def build_parser() -> argparse.ArgumentParser:
     install.add_argument("--project-root")
     install.add_argument("--asset-cache-dir", action="append", default=[])
     install.add_argument("--replace-skill", action="store_true")
-    install.add_argument("--repair-component", choices=("cli", "launcher", "analysis-skill"))
+    install.add_argument("--repair-component", choices=("cli", "launcher", "analysis-skill", "semantic-query-skill"))
     install.add_argument("--skip-cli-install", action="store_true")
     install.add_argument("--cli-command")
     install.add_argument("--progress-file")

package/docs/RELEASE-CANDIDATE-0.4.0-RC.1.md

@@ -1,61 +0,0 @@
-# Foggy DeepSeek Harness plugin 0.4.0-rc.1 release candidate
-
-Assessment date: 2026-09-05
-
-## Decision
-
-The implementation is ready for a public release-candidate build on Windows
-10/11 x64 and Linux/WSL2 x64. It remains a development and evaluation plugin;
-the bundled Runtime defaults are not a production security profile.
-
-No Java engine or `foggy-runtime-cli` source was changed for this candidate.
-The plugin consumes the independently accepted Runtime Launcher 0.1.20 and CLI
-0.1.23 releases.
-
-## Rehearsed chain
-
-1. Installed DeepSeek Harness 0.1.2-rc.1 and the packed plugin in isolated
-   Windows and WSL profiles.
-2. Downloaded and verified the managed Python 3.12.13 distribution, CLI 0.1.23,
-   Runtime Launcher 0.1.20, and analysis Skill 0.1.17.
-3. Started Java Runtime instances on both hosts and passed readiness checks.
-4. Connected the LAN MySQL demo database without restarting the active
-   development Runtime, created namespace `tms_beta18`, inspected 127 tables,
-   and selected `eo_express_order` as the waybill fact table.
-5. Validated and published one TM and one QM with 29 query fields. Eight
-   executable question-bank cases passed; three additional cases remained
-   explicit clarification or capability-gap cases.
-6. Verified Runtime 0.1.20 WARN behavior with unknown `groupBy[].grain`: the
-   query continued, and the plugin surfaced the warning code, JSON path,
-   normalized fragment, allowed properties, documentation reference, and
-   suggested action.
-7. Delivered the model as a Git bundle to `dev-kvm-jdk17`, installed a private
-   Temurin JRE 17, Python 3.12.13, CLI 0.1.23, and Launcher 0.1.20, then bound
-   the remote namespace and passed the same eight executable questions.
-8. Published model commit `3f2a019`, verified a remote query, rolled back to
-   baseline `bf6b70e`, and verified another remote query. The remote model was
-   left at the baseline revision.
-
-## Compatibility and operating boundaries
-
-- Unknown Query DSL input warnings are visible in both command output and the
-  plugin settings contract. IGNORE and STRICT remain Runtime policy choices;
-  protected authorization, datasource, namespace, model, and governance fields
-  continue to fail closed.
-- Datasource passwords are accepted directly for development experience and
-  are excluded from plugin onboarding state, evidence, TM/QM source, and Git.
-  Runtime 0.1.20 persists them in its private datasource registry; production
-  publication must use target-environment credential controls.
-- Copying a JRE from a newer Linux distribution failed on Ubuntu 22.04 because
-  of glibc compatibility. Remote deployment therefore uses an official
-  target-compatible Temurin archive with checksum verification.
-- DeepSeek Harness minimum-release-age policy can reject an immediately
-  preceding plugin version recorded in its lockfile. The documented recovery
-  is to inspect and rebuild the profile lockfile or wait for the policy window;
-  this is not handled by weakening plugin integrity checks.
-
-## Remaining publication gate
-
-The package must pass the final automated test and tarball inspection, then be
-published to npm and tagged as a GitHub prerelease from the same commit. npm and
-GitHub artifacts must be checked against the local tarball before announcement.