@aws/ml-container-creator 0.12.1 → 0.13.4

package/templates/do/deploy.d/async-inference.ejs

@@ -41,15 +41,15 @@ source "${SCRIPT_DIR}/config"
 source "${SCRIPT_DIR}/lib/profile.sh"
 
 # ── Profile-resolved variables (env var > profile > default) ──────────────────
-ROLE_ARN="${ROLE_ARN:-${_PROFILE[roleArn]:-}}"
-ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE[ecrRepositoryName]:-ml-container-creator}}"
-export AWS_REGION="${AWS_REGION:-${_PROFILE[awsRegion]:-us-east-1}}"
+ROLE_ARN="${ROLE_ARN:-${_PROFILE_roleArn:-}}"
+ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE_ecrRepositoryName:-ml-container-creator}}"
+export AWS_REGION="${AWS_REGION:-${_PROFILE_awsRegion:-us-east-1}}"
 
 # Async-specific derived variables
-_ASYNC_BUCKET="${_PROFILE[asyncS3Bucket]:-mlcc-async-${_PROFILE[accountId]:-unknown}-${_PROFILE[awsRegion]:-us-east-1}}"
+_ASYNC_BUCKET="${_PROFILE_asyncS3Bucket:-mlcc-async-${_PROFILE_accountId:-unknown}-${_PROFILE_awsRegion:-us-east-1}}"
 ASYNC_S3_OUTPUT_PATH="${ASYNC_S3_OUTPUT_PATH:-s3://${_ASYNC_BUCKET}/${PROJECT_NAME}/output/}"
-ASYNC_SNS_SUCCESS_TOPIC="${ASYNC_SNS_SUCCESS_TOPIC:-arn:aws:sns:${_PROFILE[awsRegion]:-us-east-1}:${_PROFILE[accountId]:-unknown}:ml-container-creator-${PROJECT_NAME}-async-success}"
-ASYNC_SNS_ERROR_TOPIC="${ASYNC_SNS_ERROR_TOPIC:-arn:aws:sns:${_PROFILE[awsRegion]:-us-east-1}:${_PROFILE[accountId]:-unknown}:ml-container-creator-${PROJECT_NAME}-async-error}"
+ASYNC_SNS_SUCCESS_TOPIC="${ASYNC_SNS_SUCCESS_TOPIC:-arn:aws:sns:${_PROFILE_awsRegion:-us-east-1}:${_PROFILE_accountId:-unknown}:ml-container-creator-${PROJECT_NAME}-async-success}"
+ASYNC_SNS_ERROR_TOPIC="${ASYNC_SNS_ERROR_TOPIC:-arn:aws:sns:${_PROFILE_awsRegion:-us-east-1}:${_PROFILE_accountId:-unknown}:ml-container-creator-${PROJECT_NAME}-async-error}"
 
 echo "🚀 Deploying to AWS"
 echo "   Project: ${PROJECT_NAME}"

package/templates/do/deploy.d/batch-transform.ejs

@@ -41,12 +41,12 @@ source "${SCRIPT_DIR}/config"
 source "${SCRIPT_DIR}/lib/profile.sh"
 
 # ── Profile-resolved variables (env var > profile > default) ──────────────────
-ROLE_ARN="${ROLE_ARN:-${_PROFILE[roleArn]:-}}"
-ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE[ecrRepositoryName]:-ml-container-creator}}"
-export AWS_REGION="${AWS_REGION:-${_PROFILE[awsRegion]:-us-east-1}}"
+ROLE_ARN="${ROLE_ARN:-${_PROFILE_roleArn:-}}"
+ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE_ecrRepositoryName:-ml-container-creator}}"
+export AWS_REGION="${AWS_REGION:-${_PROFILE_awsRegion:-us-east-1}}"
 
 # Batch-specific derived variables
-_BATCH_BUCKET="${_PROFILE[batchS3Bucket]:-mlcc-batch-${_PROFILE[accountId]:-unknown}-${_PROFILE[awsRegion]:-us-east-1}}"
+_BATCH_BUCKET="${_PROFILE_batchS3Bucket:-mlcc-batch-${_PROFILE_accountId:-unknown}-${_PROFILE_awsRegion:-us-east-1}}"
 BATCH_INPUT_PATH="${BATCH_INPUT_PATH:-s3://${_BATCH_BUCKET}/${PROJECT_NAME}/input/}"
 BATCH_OUTPUT_PATH="${BATCH_OUTPUT_PATH:-s3://${_BATCH_BUCKET}/${PROJECT_NAME}/output/}"
 

package/templates/do/deploy.d/hyperpod-eks.ejs

@@ -41,7 +41,7 @@ source "${SCRIPT_DIR}/config"
 source "${SCRIPT_DIR}/lib/profile.sh"
 
 # ── Profile-resolved variables (env var > profile > default) ──────────────────
-export AWS_REGION="${AWS_REGION:-${_PROFILE[awsRegion]:-us-east-1}}"
+export AWS_REGION="${AWS_REGION:-${_PROFILE_awsRegion:-us-east-1}}"
 
 echo "🚀 Deploying to AWS"
 echo "   Project: ${PROJECT_NAME}"

package/templates/do/deploy.d/managed-inference.ejs

@@ -214,9 +214,9 @@ source "${SCRIPT_DIR}/config"
 source "${SCRIPT_DIR}/lib/profile.sh"
 
 # ── Profile-resolved variables (env var > profile > default) ──────────────────
-ROLE_ARN="${ROLE_ARN:-${_PROFILE[roleArn]:-}}"
-ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE[ecrRepositoryName]:-ml-container-creator}}"
-export AWS_REGION="${AWS_REGION:-${_PROFILE[awsRegion]:-us-east-1}}"
+ROLE_ARN="${ROLE_ARN:-${_PROFILE_roleArn:-}}"
+ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE_ecrRepositoryName:-ml-container-creator}}"
+export AWS_REGION="${AWS_REGION:-${_PROFILE_awsRegion:-us-east-1}}"
 
 echo "🚀 Deploying to AWS"
 echo "   Project: ${PROJECT_NAME}"
@@ -329,6 +329,18 @@ if [ -z "${ROLE_ARN:-}" ]; then
     exit 3
 fi
 
+# Validate ROLE_ARN looks like an IAM role ARN
+if ! echo "${ROLE_ARN}" | grep -qE '^arn:aws[a-z-]*:iam::[0-9]{12}:role/.+'; then
+    echo "❌ ROLE_ARN is not a valid IAM role ARN:"
+    echo "   Got: ${ROLE_ARN}"
+    echo "   Expected format: arn:aws:iam::123456789012:role/RoleName"
+    echo ""
+    echo "   This may indicate a misconfigured bootstrap profile."
+    echo "   Check ~/.ml-container-creator/config.json 'roleArn' field,"
+    echo "   or set the correct value: export ROLE_ARN=arn:aws:iam::ACCOUNT:role/YOUR_ROLE"
+    exit 3
+fi
+
 echo "   Using execution role: ${ROLE_ARN}"
 
 # Validate --ic argument if specified (set by --ic <name> or --force-ic <name>)

package/templates/do/lib/profile.sh

@@ -1,21 +1,27 @@
 #!/usr/bin/env bash
-# Profile loader — reads active bootstrap profile into _PROFILE[] associative array.
+# Profile loader — reads active bootstrap profile into _PROFILE_<key> variables.
 # Source this file after do/config. Values provide defaults; explicit env vars take precedence.
 #
-# Requires bash 4+ for associative array support.
-# macOS ships with bash 3.2 — install bash 4+ via Homebrew: brew install bash
+# POSIX-compatible: works on bash 3.2+ (macOS default) and bash 4+/5+.
+# No associative arrays required.
 #
-# Expected keys in _PROFILE:
+# After sourcing, access values via:
+#   ${_PROFILE_roleArn:-}
+#   ${_PROFILE_ecrRepositoryName:-ml-container-creator}
+#   ${_PROFILE_awsRegion:-us-east-1}
+#   ${_PROFILE_accountId:-}
+#   ${_PROFILE_benchmarkS3Bucket:-}
+#   ${_PROFILE_asyncS3Bucket:-}
+#   ${_PROFILE_batchS3Bucket:-}
+#
+# Expected keys (set as _PROFILE_<key>):
 #   awsRegion, accountId, awsProfile, roleArn, ecrRepositoryName,
 #   benchmarkS3Bucket, ciBenchmarkResultsBucket, asyncS3Bucket, batchS3Bucket,
 #   ciTableName, ciInfraProvisioned
 
 # Temporarily disable unbound variable checking for profile loading
-# (keys may not exist in the profile config, and declare -A behavior
-# varies across bash versions with set -u)
 set +u 2>/dev/null || true
 
-declare -A _PROFILE 2>/dev/null || true
 if command -v python3 &>/dev/null; then
     _PROFILE_RAW=$(python3 -c "
 import json, os
@@ -23,22 +29,20 @@ try:
     with open(os.path.expanduser('~/.ml-container-creator/config.json')) as f:
         c = json.load(f)
     p = c['profiles'][c['activeProfile']]
-    # Output as KEY=VALUE lines (simple, no JSON parsing in bash)
+    # Output as _PROFILE_KEY=VALUE lines — safe for eval with known prefix
     for k, v in p.items():
         if isinstance(v, (str, int, float, bool)):
-            print(f'{k}={v}')
+            # Sanitize: only allow alphanumeric key names
+            if k.isalnum() or all(c.isalnum() or c == '_' for c in k):
+                print(f'_PROFILE_{k}=\"{v}\"')
 except:
     pass
 " 2>/dev/null) || _PROFILE_RAW=""
 
     if [ -n "${_PROFILE_RAW}" ]; then
-        while IFS='=' read -r key value; do
-            [ -n "${key}" ] && _PROFILE["${key}"]="${value}"
-        done <<< "${_PROFILE_RAW}"
+        eval "${_PROFILE_RAW}"
     fi
 fi
 
 # NOTE: set -u is NOT re-enabled here. The caller is responsible for managing
-# their own shell options. Re-enabling set -u would cause "unbound variable"
-# errors when accessing _PROFILE keys on bash versions where empty associative
-# arrays are treated as unset (bash 5.x on some platforms).
+# their own shell options.

package/templates/do/lib/staged-assets.sh

@@ -0,0 +1,217 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Shared helper: read/write the .mlcc/staged-assets.json tracking file.
+# Sourced by do/stage, do/submit, and other lifecycle scripts.
+#
+# ─── Schema (.mlcc/staged-assets.json) ───────────────────────────────────────
+#
+# {
+#   "version": "1",
+#   "models": {
+#     "<ic-name>": {
+#       "source":     "<HuggingFace model ID, e.g. google/gemma-4-31B-it>",
+#       "staged_uri": "<S3 URI with trailing slash>",
+#       "staged_at":  "<ISO 8601 timestamp>",
+#       "region":     "<AWS region where the model was staged>",
+#       "size_gb":    <numeric size in GB>
+#     }
+#   },
+#   "adapters": {}
+# }
+#
+# Notes:
+#   - "version" is for forward-compatible schema evolution (start at "1")
+#   - "models" is keyed by IC name; use "default" for single-model projects
+#   - "adapters" is reserved for future LoRA adapter staging (BL-122)
+#   - This file is git-ignored (.mlcc/ contains account-specific URIs)
+#   - The file SHALL NOT be created unless a valid staging operation completes
+# ──────────────────────────────────────────────────────────────────────────────
+
+# Path to the staged-assets file (relative to project root)
+STAGED_ASSETS_DIR=".mlcc"
+STAGED_ASSETS_FILE="${STAGED_ASSETS_DIR}/staged-assets.json"
+
+# _staged_assets_has_jq()
+#   Check if jq is available on the system.
+#   Returns 0 if available, 1 if not.
+_staged_assets_has_jq() {
+    command -v jq &>/dev/null
+}
+
+# _staged_assets_warn_no_jq()
+#   Print a one-time warning when jq is not available.
+_staged_assets_warn_no_jq() {
+    if [ -z "${_STAGED_ASSETS_JQ_WARNED:-}" ]; then
+        echo "⚠️  jq not found — using fallback parser (install jq for full functionality)" >&2
+        _STAGED_ASSETS_JQ_WARNED=1
+    fi
+}
+
+# staged_assets_read_model_uri()
+#   Read the staged S3 URI for the default model from the staged-assets file.
+#   Echoes the S3 URI if found, or an empty string if not available.
+#
+#   Uses jq when available; falls back to grep/sed extraction.
+#
+#   Arguments: none
+#   Output:    S3 URI string (stdout) or empty string
+staged_assets_read_model_uri() {
+    local uri=""
+
+    # No file → empty string
+    if [ ! -f "${STAGED_ASSETS_FILE}" ]; then
+        echo ""
+        return 0
+    fi
+
+    if _staged_assets_has_jq; then
+        uri=$(jq -r '.models.default.staged_uri // empty' "${STAGED_ASSETS_FILE}" 2>/dev/null) || uri=""
+    else
+        _staged_assets_warn_no_jq
+        # Fallback: grep/sed extraction for the staged_uri field within the default model block
+        # This handles the common single-model case reliably
+        uri=$(grep -A 5 '"default"' "${STAGED_ASSETS_FILE}" 2>/dev/null \
+            | grep '"staged_uri"' \
+            | sed 's/.*"staged_uri"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/' \
+            | head -1) || uri=""
+    fi
+
+    echo "${uri}"
+}
+
+# staged_assets_write_model()
+#   Create or update the staged-assets file with model staging information.
+#   Creates the .mlcc directory if it does not exist.
+#
+#   Arguments:
+#     $1 - source:   HuggingFace model ID (e.g. "google/gemma-4-31B-it")
+#     $2 - uri:      S3 URI where the model was staged (with trailing slash)
+#     $3 - region:   AWS region where the model was staged
+#     $4 - size_gb:  Total size of the staged model in GB (numeric)
+staged_assets_write_model() {
+    local source="$1"
+    local uri="$2"
+    local region="$3"
+    local size_gb="$4"
+    local timestamp
+    timestamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+    # Ensure the .mlcc directory exists
+    mkdir -p "${STAGED_ASSETS_DIR}"
+
+    if _staged_assets_has_jq; then
+        if [ -f "${STAGED_ASSETS_FILE}" ]; then
+            # Update existing file — merge the new model entry
+            local tmp_file="${STAGED_ASSETS_FILE}.tmp"
+            jq --arg source "${source}" \
+               --arg uri "${uri}" \
+               --arg ts "${timestamp}" \
+               --arg region "${region}" \
+               --argjson size "${size_gb}" \
+               '.models.default = {
+                   "source": $source,
+                   "staged_uri": $uri,
+                   "staged_at": $ts,
+                   "region": $region,
+                   "size_gb": $size
+               }' "${STAGED_ASSETS_FILE}" > "${tmp_file}" && mv "${tmp_file}" "${STAGED_ASSETS_FILE}"
+        else
+            # Create new file from scratch
+            jq -n --arg source "${source}" \
+                  --arg uri "${uri}" \
+                  --arg ts "${timestamp}" \
+                  --arg region "${region}" \
+                  --argjson size "${size_gb}" \
+                  '{
+                      "version": "1",
+                      "models": {
+                          "default": {
+                              "source": $source,
+                              "staged_uri": $uri,
+                              "staged_at": $ts,
+                              "region": $region,
+                              "size_gb": $size
+                          }
+                      },
+                      "adapters": {}
+                  }' > "${STAGED_ASSETS_FILE}"
+        fi
+    else
+        _staged_assets_warn_no_jq
+        # Fallback: write the JSON directly (create-only, no merge support without jq)
+        cat > "${STAGED_ASSETS_FILE}" << EOF
+{
+  "version": "1",
+  "models": {
+    "default": {
+      "source": "${source}",
+      "staged_uri": "${uri}",
+      "staged_at": "${timestamp}",
+      "region": "${region}",
+      "size_gb": ${size_gb}
+    }
+  },
+  "adapters": {}
+}
+EOF
+    fi
+}
+
+# staged_assets_status()
+#   Print a human-readable table of all staged assets.
+#   Shows models and adapters with their source, URI, region, size, and timestamp.
+#
+#   Arguments: none
+#   Output:    formatted table to stdout
+staged_assets_status() {
+    if [ ! -f "${STAGED_ASSETS_FILE}" ]; then
+        echo "No staged assets found."
+        echo "  Run do/stage to stage model weights to S3."
+        return 0
+    fi
+
+    echo "Staged Assets (.mlcc/staged-assets.json)"
+    echo "─────────────────────────────────────────────────────────────────"
+
+    if _staged_assets_has_jq; then
+        # Print models section
+        local model_count
+        model_count=$(jq -r '.models | length' "${STAGED_ASSETS_FILE}" 2>/dev/null) || model_count=0
+
+        if [ "${model_count}" -gt 0 ]; then
+            echo ""
+            echo "  Models:"
+            echo "  ┌──────────────┬─────────────────────────────────┬──────────────────────────────────────────────────────┬────────────┬─────────┐"
+            printf "  │ %-12s │ %-31s │ %-52s │ %-10s │ %-7s │\n" "IC Name" "Source" "S3 URI" "Region" "Size"
+            echo "  ├──────────────┼─────────────────────────────────┼──────────────────────────────────────────────────────┼────────────┼─────────┤"
+
+            jq -r '.models | to_entries[] | "\(.key)\t\(.value.source)\t\(.value.staged_uri)\t\(.value.region)\t\(.value.size_gb)"' "${STAGED_ASSETS_FILE}" 2>/dev/null | \
+            while IFS=$'\t' read -r ic_name source staged_uri region size_gb; do
+                printf "  │ %-12s │ %-31s │ %-52s │ %-10s │ %5s GB│\n" \
+                    "${ic_name}" "${source}" "${staged_uri}" "${region}" "${size_gb}"
+            done
+
+            echo "  └──────────────┴─────────────────────────────────┴──────────────────────────────────────────────────────┴────────────┴─────────┘"
+        fi
+
+        # Print adapters section (future — show placeholder if empty)
+        local adapter_count
+        adapter_count=$(jq -r '.adapters | length' "${STAGED_ASSETS_FILE}" 2>/dev/null) || adapter_count=0
+
+        if [ "${adapter_count}" -gt 0 ]; then
+            echo ""
+            echo "  Adapters:"
+            jq -r '.adapters | to_entries[] | "    \(.key): \(.value.staged_uri // "not staged")"' "${STAGED_ASSETS_FILE}" 2>/dev/null
+        fi
+    else
+        _staged_assets_warn_no_jq
+        # Fallback: basic display without jq
+        echo ""
+        echo "  Raw contents:"
+        echo ""
+        cat "${STAGED_ASSETS_FILE}"
+    fi
+
+    echo ""
+}

package/templates/do/push

@@ -12,8 +12,8 @@ source "${SCRIPT_DIR}/config"
 source "${SCRIPT_DIR}/lib/profile.sh"
 
 # ── Profile-resolved variables (env var > profile > default) ──────────────────
-ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE[ecrRepositoryName]:-ml-container-creator}}"
-export AWS_REGION="${AWS_REGION:-${_PROFILE[awsRegion]:-us-east-1}}"
+ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE_ecrRepositoryName:-ml-container-creator}}"
+export AWS_REGION="${AWS_REGION:-${_PROFILE_awsRegion:-us-east-1}}"
 
 echo "🚀 Pushing Docker image to Amazon ECR"
 echo "   Project: ${PROJECT_NAME}"

package/templates/do/register

@@ -12,8 +12,8 @@ source "${SCRIPT_DIR}/config"
 source "${SCRIPT_DIR}/lib/profile.sh"
 
 # ── Profile-resolved variables (env var > profile > default) ──────────────────
-ROLE_ARN="${ROLE_ARN:-${_PROFILE[roleArn]:-}}"
-ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE[ecrRepositoryName]:-ml-container-creator}}"
+ROLE_ARN="${ROLE_ARN:-${_PROFILE_roleArn:-}}"
+ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE_ecrRepositoryName:-ml-container-creator}}"
 
 # ============================================================
 # Register deployment to the deployment registry

package/templates/do/stage

@@ -23,40 +23,42 @@ set -o pipefail
 # ── Source project configuration ──────────────────────────────────────────────
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/config"
+source "${SCRIPT_DIR}/lib/profile.sh"
+source "${SCRIPT_DIR}/lib/staged-assets.sh"
 
 # ── Parse flags ───────────────────────────────────────────────────────────────
 FORCE=false
-UPDATE_CONFIG=false
+UPDATE_CONFIG=true
 SUBMIT_MODE=false
 NO_WAIT=false
 while [ $# -gt 0 ]; do
     case "$1" in
         --force) FORCE=true; shift ;;
-        --update-config) UPDATE_CONFIG=true; shift ;;
+        --update-config) UPDATE_CONFIG=true; shift ;; # default, kept for backward compat
+        --no-update-config) UPDATE_CONFIG=false; shift ;;
         --submit) SUBMIT_MODE=true; shift ;;
         --no-wait) NO_WAIT=true; shift ;;
         --help|-h)
-            echo "Usage: ./do/stage [--force] [--update-config] [--submit] [--no-wait]"
+            echo "Usage: ./do/stage [--force] [--no-update-config] [--submit] [--no-wait]"
             echo ""
             echo "Pre-stage model weights from HuggingFace to S3."
+            echo "On success, updates MODEL_NAME in do/config so subsequent tasks"
+            echo "(submit, deploy) pull from S3 with HuggingFace as fallback."
             echo ""
             echo "Modes:"
             echo "  (default)    Download locally then sync to S3"
             echo "  --submit     Submit as SageMaker Processing Job (for models >500GB)"
             echo ""
             echo "Options:"
-            echo "  --force          Re-stage even if model already exists in S3"
-            echo "  --update-config  Update MODEL_NAME in do/config to the staged S3 URI"
-            echo "  --no-wait        (with --submit) Exit without polling for completion"
+            echo "  --force             Re-stage even if model already exists in S3"
+            echo "  --no-update-config  Do NOT update MODEL_NAME in do/config after staging"
+            echo "  --no-wait           (with --submit) Exit without polling for completion"
             echo ""
             echo "Environment:"
             echo "  HF_TOKEN   HuggingFace token (for gated models)"
             echo ""
             echo "The staged S3 URI will be printed on completion."
-            echo "Pass --update-config to automatically update do/config for S3-backed deploys."
-            echo ""
-            echo "The --submit mode uses a SageMaker Processing Job with 2TB attached"
-            echo "storage, suitable for very large models that exceed local disk capacity."
+            echo "MODEL_NAME in do/config is updated automatically unless --no-update-config is passed."
             exit 0
             ;;
         *) shift ;;
@@ -126,11 +128,16 @@ echo "Target: ${S3_OUTPUT_URI}"
 echo ""
 
 # Install dependencies
-echo "📦 Installing huggingface-cli and hf_transfer..."
-pip install -q huggingface_hub[cli] hf_transfer
+echo "📦 Checking huggingface-cli and hf_transfer..."
+pip install -q huggingface_hub[cli] hf_transfer 2>/dev/null || true
 
-# Enable fast parallel downloads
-export HF_HUB_ENABLE_HF_TRANSFER=1
+# Enable fast parallel downloads only if hf_transfer is available
+if python3 -c "import hf_transfer" 2>/dev/null; then
+    export HF_HUB_ENABLE_HF_TRANSFER=1
+else
+    echo "   ℹ️  hf_transfer not available — using standard download (install with: pip install hf_transfer)"
+    unset HF_HUB_ENABLE_HF_TRANSFER 2>/dev/null || true
+fi
 
 # Set HF token if provided
 if [ -n "${HF_TOKEN:-}" ]; then
@@ -324,15 +331,11 @@ print(d.get('FailureReason', ''))
                     CONFIG_FILE="${SCRIPT_DIR}/config"
                     sed -i.bak "s|^export MODEL_NAME=.*|export MODEL_NAME=\"${MODEL_S3_URI}\"|" "${CONFIG_FILE}"
                     rm -f "${CONFIG_FILE}.bak"
-                    echo "   ✅ Updated MODEL_NAME in do/config → ${MODEL_S3_URI}"
-                    echo ""
-                    echo "   Re-deploy with S3-backed model: ./do/deploy"
+                    echo "   ✅ Updated MODEL_NAME in do/config → S3-backed"
+                    echo "   Subsequent tasks (submit, deploy) will pull from S3."
                 else
                     echo "   To use this staged model, update do/config:"
                     echo "   export MODEL_NAME=\"${MODEL_S3_URI}\""
-                    echo ""
-                    echo "   Or re-run with --update-config:"
-                    echo "   ./do/stage --submit --update-config"
                 fi
                 return 0
                 ;;
@@ -431,7 +434,7 @@ if [ "${FORCE}" = false ]; then
             CONFIG_FILE="${SCRIPT_DIR}/config"
             sed -i.bak "s|^export MODEL_NAME=.*|export MODEL_NAME=\"${MODEL_S3_URI}\"|" "${CONFIG_FILE}"
             rm -f "${CONFIG_FILE}.bak"
-            echo "   ✅ Updated MODEL_NAME in do/config → ${MODEL_S3_URI}"
+            echo "   ✅ Updated MODEL_NAME in do/config → S3-backed"
         else
             echo "   To use this staged model, set in do/config:"
             echo "   export MODEL_NAME=\"${MODEL_S3_URI}\""
@@ -472,13 +475,21 @@ fi
 
 # ── Download model from HuggingFace ──────────────────────────────────────────
 echo "⬇️  Downloading model from HuggingFace: ${MODEL_NAME}"
-echo "   Using hf_transfer for fast parallel downloads..."
+if python3 -c "import hf_transfer" 2>/dev/null; then
+    echo "   Using hf_transfer for fast parallel downloads..."
+else
+    echo "   Using standard downloads (install hf_transfer for faster staging)..."
+fi
 echo ""
 
-# Enable fast parallel downloads via hf_transfer
-export HF_HUB_ENABLE_HF_TRANSFER=1
+# Enable fast parallel downloads via hf_transfer (if available)
+if python3 -c "import hf_transfer" 2>/dev/null; then
+    export HF_HUB_ENABLE_HF_TRANSFER=1
+else
+    unset HF_HUB_ENABLE_HF_TRANSFER 2>/dev/null || true
+fi
 
-# Download to HF cache (huggingface-cli manages cache location)
+# Download to HF cache
 DOWNLOAD_ARGS=("${MODEL_NAME}")
 if [ -n "${HF_TOKEN:-}" ]; then
     DOWNLOAD_ARGS+=("--token" "${HF_TOKEN}")
@@ -553,15 +564,9 @@ if [ "${UPDATE_CONFIG}" = true ]; then
     CONFIG_FILE="${SCRIPT_DIR}/config"
     sed -i.bak "s|^export MODEL_NAME=.*|export MODEL_NAME=\"${MODEL_S3_URI}\"|" "${CONFIG_FILE}"
     rm -f "${CONFIG_FILE}.bak"
-    echo "   ✅ Updated MODEL_NAME in do/config → ${MODEL_S3_URI}"
-    echo ""
-    echo "   Re-deploy with S3-backed model: ./do/deploy"
+    echo "   ✅ Updated MODEL_NAME in do/config → S3-backed"
+    echo "   Subsequent tasks (submit, deploy) will pull from S3."
 else
     echo "   To use this staged model, update do/config:"
     echo "   export MODEL_NAME=\"${MODEL_S3_URI}\""
-    echo ""
-    echo "   Or re-run with --update-config to do it automatically:"
-    echo "   ./do/stage --update-config"
-    echo ""
-    echo "   Then re-deploy: ./do/deploy"
 fi

package/templates/do/submit

@@ -12,7 +12,7 @@ source "${SCRIPT_DIR}/config"
 source "${SCRIPT_DIR}/lib/profile.sh"
 
 # ── Profile-resolved variables (env var > profile > default) ──────────────────
-ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE[ecrRepositoryName]:-ml-container-creator}}"
+ECR_REPOSITORY_NAME="${ECR_REPOSITORY_NAME:-${_PROFILE_ecrRepositoryName:-ml-container-creator}}"
 
 # ── Derived variables (env var > computed default) ────────────────────────────
 CODEBUILD_PROJECT_NAME="${CODEBUILD_PROJECT_NAME:-${PROJECT_NAME}-build-$(date +%Y%m%d)}"

package/templates/do/tune

@@ -16,7 +16,7 @@ source "${SCRIPT_DIR}/config"
 source "${SCRIPT_DIR}/lib/profile.sh"
 
 # ── Profile-resolved variables (env var > profile > default) ──────────────────
-TUNE_S3_BUCKET="${TUNE_S3_BUCKET:-mlcc-tune-${_PROFILE[accountId]:-unknown}-${_PROFILE[awsRegion]:-us-east-1}}"
+TUNE_S3_BUCKET="${TUNE_S3_BUCKET:-mlcc-tune-${_PROFILE_accountId:-unknown}-${_PROFILE_awsRegion:-us-east-1}}"
 
 # ── Constants ─────────────────────────────────────────────────────────────────
 CATALOG_FILE="${SCRIPT_DIR}/.tune_catalog.json"