@aws/ml-container-creator 0.13.4 → 0.15.0

package/templates/do/add-ic

@@ -123,6 +123,71 @@ if [ -n "${MODEL_DATA}" ]; then
 fi
 echo ""
 
+# ============================================================
+# Query model registry for available versions (AC-5.1)
+# Non-intrusive: if registry query fails, skip silently
+# ============================================================
+REGISTRY_MODELS_JSON=""
+REGISTRY_MODEL_COUNT=0
+REGISTRY_SELECTED_MODEL_DATA=""
+REGISTRY_SELECTED_IMAGE=""
+
+if [ -z "${MODEL_DATA}" ]; then
+    # Only query registry if MODEL_DATA was not already provided via --from-tune or --model-data
+    if [ -t 0 ]; then
+        # Interactive mode: query registry for available models
+        _registry_json=$(python3 "${SCRIPT_DIR}/.register_helper.py" list-models \
+            --project-name "${PROJECT_NAME}" \
+            --region "${AWS_REGION:-us-east-1}" 2>/dev/null || echo "")
+
+        _registry_line=$(echo "${_registry_json}" | grep -E '^\{' | tail -1)
+
+        if [ -n "${_registry_line}" ]; then
+            REGISTRY_MODEL_COUNT=$(echo "${_registry_line}" | python3 -c "import sys,json; data=json.loads(sys.stdin.read()); print(len(data.get('models',[])))" 2>/dev/null || echo "0")
+
+            if [ "${REGISTRY_MODEL_COUNT}" -gt 0 ]; then
+                REGISTRY_MODELS_JSON="${_registry_line}"
+
+                echo "📦 Available registered models:"
+                echo ""
+                printf '  %-4s%-10s%-12s%-38s%s\n' "#" "VERSION" "CONFIG" "MODEL" "INSTANCE"
+
+                _i=0
+                while [ "${_i}" -lt "${REGISTRY_MODEL_COUNT}" ]; do
+                    _v=$(echo "${REGISTRY_MODELS_JSON}" | python3 -c "import sys,json; data=json.loads(sys.stdin.read()); print(data['models'][${_i}].get('version','?'))" 2>/dev/null)
+                    _c=$(echo "${REGISTRY_MODELS_JSON}" | python3 -c "import sys,json; data=json.loads(sys.stdin.read()); print(data['models'][${_i}].get('deploymentConfig','?'))" 2>/dev/null)
+                    _m=$(echo "${REGISTRY_MODELS_JSON}" | python3 -c "import sys,json; data=json.loads(sys.stdin.read()); m=data['models'][${_i}].get('modelName','?'); print(m[:36]+'…' if len(m)>36 else m)" 2>/dev/null)
+                    _inst=$(echo "${REGISTRY_MODELS_JSON}" | python3 -c "import sys,json; data=json.loads(sys.stdin.read()); print(data['models'][${_i}].get('instanceType','?'))" 2>/dev/null)
+
+                    _num=$((_i + 1))
+                    printf '  %-4s%-10s%-12s%-38s%s\n' "${_num}" "v${_v}" "${_c}" "${_m}" "${_inst}"
+                    _i=$((_i + 1))
+                done
+
+                echo ""
+                read -p "Select a model (1-${REGISTRY_MODEL_COUNT}) or press Enter to specify manually: " _selection
+
+                if [ -n "${_selection}" ]; then
+                    # Validate selection
+                    if echo "${_selection}" | grep -qE '^[0-9]+$' && [ "${_selection}" -ge 1 ] && [ "${_selection}" -le "${REGISTRY_MODEL_COUNT}" ]; then
+                        _sel_idx=$((_selection - 1))
+                        REGISTRY_SELECTED_MODEL_DATA=$(echo "${REGISTRY_MODELS_JSON}" | python3 -c "import sys,json; data=json.loads(sys.stdin.read()); print(data['models'][${_sel_idx}].get('modelDataUrl',''))" 2>/dev/null || echo "")
+                        REGISTRY_SELECTED_IMAGE=$(echo "${REGISTRY_MODELS_JSON}" | python3 -c "import sys,json; data=json.loads(sys.stdin.read()); img=data['models'][${_sel_idx}].get('containerImage',''); print(img.split('/')[-1] if '/' in img else img)" 2>/dev/null || echo "")
+
+                        echo ""
+                        echo "✅ Selected registry model v$(echo "${REGISTRY_MODELS_JSON}" | python3 -c "import sys,json; data=json.loads(sys.stdin.read()); print(data['models'][${_sel_idx}].get('version','?'))" 2>/dev/null)"
+                        echo ""
+                    else
+                        echo "   ⚠️  Invalid selection, proceeding with manual entry."
+                        echo ""
+                    fi
+                fi
+                # If user pressed Enter without selection, proceed with manual entry
+            fi
+        fi
+    fi
+fi
+
 # ============================================================
 # Prompt for IC name (if not provided as argument)
 # ============================================================
@@ -169,12 +234,29 @@ else
 fi
 
 # ============================================================
-# Prompt for image tag
+# Prompt for image tag (AC-5.2, AC-5.3: pre-fill from registry, user can override)
 # ============================================================
-DEFAULT_IMAGE_TAG="${PROJECT_NAME}-latest"
+if [ -n "${REGISTRY_SELECTED_IMAGE}" ]; then
+    DEFAULT_IMAGE_TAG="${REGISTRY_SELECTED_IMAGE}"
+else
+    DEFAULT_IMAGE_TAG="${PROJECT_NAME}-latest"
+fi
 read -p "Image tag [${DEFAULT_IMAGE_TAG}]: " IC_IMAGE_TAG
 IC_IMAGE_TAG="${IC_IMAGE_TAG:-${DEFAULT_IMAGE_TAG}}"
 
+# ============================================================
+# Prompt for model data URL (AC-5.2, AC-5.3: pre-fill from registry, user can override)
+# ============================================================
+if [ -z "${MODEL_DATA}" ] && [ -n "${REGISTRY_SELECTED_MODEL_DATA}" ]; then
+    # Pre-fill from registry selection — user can override (AC-5.3)
+    read -p "Model data URL [${REGISTRY_SELECTED_MODEL_DATA}]: " _model_data_input
+    MODEL_DATA="${_model_data_input:-${REGISTRY_SELECTED_MODEL_DATA}}"
+elif [ -z "${MODEL_DATA}" ]; then
+    # No registry selection — offer manual entry (optional)
+    read -p "Model data URL (S3 URI, optional — press Enter to skip): " _model_data_input
+    MODEL_DATA="${_model_data_input:-}"
+fi
+
 # ============================================================
 # Prompt for GPU count
 # ============================================================
@@ -232,7 +314,7 @@ export IC_MIN_MEMORY_MB=${IC_MIN_MEMORY_MB}
 export IC_STARTUP_TIMEOUT=900
 EOF
 
-# Add model data if provided (from --from-tune or --model-data)
+# Add model data if provided (from --from-tune, --model-data, or registry selection)
 if [ -n "${MODEL_DATA}" ]; then
     cat >> "${IC_CONF_PATH}" <<EOF
 export IC_MODEL_DATA="${MODEL_DATA}"

package/templates/do/benchmark

@@ -12,10 +12,12 @@ set -o pipefail
 # ── Source project configuration ──────────────────────────────────────────────
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/config"
+source "${SCRIPT_DIR}/lib/profile.sh"
 
 # ── Parse flags ───────────────────────────────────────────────────────────────
 CLEAN_AFTER=false
 FORCE=false
+ARG_STATUS=false
 IC_ARG=""
 ADAPTER_ARG=""
 ARG_NO_STALE_WARNING=false
@@ -24,18 +26,20 @@ while [ $# -gt 0 ]; do
     case "$1" in
         --clean) CLEAN_AFTER=true; shift ;;
         --force) FORCE=true; shift ;;
+        --status) ARG_STATUS=true; shift ;;
         --no-stale-warning) ARG_NO_STALE_WARNING=true; shift ;;
         --workload) shift; ARG_WORKLOAD="${1:-}"; shift ;;
         --ic) shift; IC_ARG="${1:-}"; shift ;;
         --adapter) shift; ADAPTER_ARG="${1:-}"; shift ;;
         --help|-h)
-            echo "Usage: ./do/benchmark [--workload <name>] [--ic <name>] [--adapter <name>] [--force] [--clean] [--no-stale-warning]"
+            echo "Usage: ./do/benchmark [--workload <name>] [--status] [--ic <name>] [--adapter <name>] [--force] [--clean]"
             echo ""
             echo "Run SageMaker AI Benchmark against the deployed endpoint."
             echo ""
             echo "Options:"
+            echo "  --status            Check job status; if completed, download results + write to Athena"
             echo "  --ic <name>         Benchmark a specific inference component"
-            echo "  --adapter <name>    Benchmark a specific LoRA adapter IC"
+            echo "  --adapter <name>    Benchmark a specific LoRA adapter (routes via adapter IC, records adapter_name in Athena)"
             echo "  --force             Create a new benchmark job even if one is already running"
             echo "  --clean             Delete workload config and benchmark job after displaying results"
             echo "  --no-stale-warning  Suppress schema registry staleness warning"
@@ -45,9 +49,11 @@ while [ $# -gt 0 ]; do
             echo "  --ic <name>      Use IC_DEPLOYED_NAME from do/ic/<name>.conf"
             echo "  (no flag)        Use first IC in do/ic/ alphabetically, or legacy config"
             echo ""
-            echo "Idempotency:"
-            echo "  If a benchmark job is already in progress, re-running without --force"
-            echo "  will resume waiting for the existing job and display its results."
+            echo "Adapter benchmarks are differentiated from base model runs in Athena via the adapter_name column."
+            echo ""
+            echo "Status:"
+            echo "  After interrupting a running benchmark, use --status to check completion"
+            echo "  and trigger results download + Athena write."
             echo ""
             echo "Prerequisites:"
             echo "  • Endpoint must be deployed and InService (run ./do/deploy first)"
@@ -59,6 +65,120 @@ while [ $# -gt 0 ]; do
 done
 
 
+# ── Handle --status (early exit) ─────────────────────────────────────────────
+# Query the tracked benchmark job, display status, and if completed:
+# download results, display metrics, and write to Athena (if not already done).
+if [ "${ARG_STATUS}" = true ]; then
+    JOB_NAME="${BENCHMARK_JOB_NAME:-}"
+    if [ -z "${JOB_NAME}" ]; then
+        echo "❌ No benchmark job tracked"
+        echo "   Run ./do/benchmark --workload <name> to start one."
+        exit 1
+    fi
+
+    echo "📊 Benchmark Job Status"
+    echo ""
+    echo "   Job: ${JOB_NAME}"
+
+    STATUS=$(aws sagemaker describe-ai-benchmark-job \
+        --ai-benchmark-job-name "${JOB_NAME}" \
+        --region "${AWS_REGION}" \
+        --query 'AIBenchmarkJobStatus' \
+        --output text 2>/dev/null) || STATUS=""
+
+    if [ -z "${STATUS}" ]; then
+        echo "   Status: Unknown (job not found or credentials expired)"
+        exit 1
+    fi
+
+    echo "   Status: ${STATUS}"
+
+    case "${STATUS}" in
+        Completed)
+            # Check if results already exist locally
+            PROJECT_ROOT="${SCRIPT_DIR}/.."
+            LOCAL_RESULTS_DIR="${PROJECT_ROOT}/benchmarks/${JOB_NAME}"
+            RESULTS_JSONL=$(find "${LOCAL_RESULTS_DIR}" -name "profile_export.jsonl" -type f 2>/dev/null | head -1)
+
+            if [ -z "${RESULTS_JSONL}" ]; then
+                echo ""
+                echo "   📥 Downloading results..."
+                RESULTS_S3_PATH=$(aws sagemaker describe-ai-benchmark-job \
+                    --ai-benchmark-job-name "${JOB_NAME}" \
+                    --region "${AWS_REGION}" \
+                    --query 'OutputConfig.S3OutputLocation' \
+                    --output text 2>/dev/null)
+
+                if [ -n "${RESULTS_S3_PATH}" ]; then
+                    mkdir -p "${LOCAL_RESULTS_DIR}/output"
+                    aws s3 sync "${RESULTS_S3_PATH}" "${LOCAL_RESULTS_DIR}/output/" \
+                        --region "${AWS_REGION}" --quiet
+                    # Untar if output.tar.gz exists
+                    tar_file=""
+                    tar_file=$(find "${LOCAL_RESULTS_DIR}" -name "output.tar.gz" -type f 2>/dev/null | head -1)
+                    if [ -n "${tar_file}" ]; then
+                        # Detect whether tar has a leading directory prefix
+                        _tar_first=""
+                        _tar_first=$(tar -tzf "${tar_file}" 2>/dev/null | head -1)
+                        if echo "${_tar_first}" | grep -qE '^[^/]+/$'; then
+                            tar -xzf "${tar_file}" --strip-components=1 -C "${LOCAL_RESULTS_DIR}/output/" 2>/dev/null || true
+                        else
+                            tar -xzf "${tar_file}" -C "${LOCAL_RESULTS_DIR}/output/" 2>/dev/null || true
+                        fi
+                    fi
+                    # Re-search after extraction
+                    RESULTS_JSONL=$(find "${LOCAL_RESULTS_DIR}" -name "profile_export.jsonl" -type f 2>/dev/null | head -1)
+                    echo "   ✅ Results downloaded to: benchmarks/${JOB_NAME}/"
+                fi
+            else
+                echo "   ✅ Results already available locally"
+            fi
+
+            # Write to Athena if CI bucket is configured and results exist
+            if [ -n "${CI_BENCHMARK_RESULTS_BUCKET:-}" ]; then
+                _WRITER_INPUT=""
+                if [ -n "${RESULTS_JSONL}" ] && [ -f "${RESULTS_JSONL}" ]; then
+                    _WRITER_INPUT="${RESULTS_JSONL}"
+                else
+                    _WRITER_INPUT=$(find "${LOCAL_RESULTS_DIR}" -name "profile_export_aiperf.json" -type f 2>/dev/null | head -1)
+                fi
+
+                if [ -n "${_WRITER_INPUT}" ]; then
+                    echo ""
+                    echo "   📊 Writing to Athena..."
+                    if python3 "$(dirname "${BASH_SOURCE[0]}")/.benchmark_writer.py" write \
+                        --results-file "${_WRITER_INPUT}" \
+                        --config-file "$(dirname "${BASH_SOURCE[0]}")/config" \
+                        --project-name "${PROJECT_NAME}" \
+                        --workload "${BENCHMARK_WORKLOAD:-manual}" \
+                        --concurrency "${BENCHMARK_CONCURRENCY:-2}" \
+                        --bucket "${CI_BENCHMARK_RESULTS_BUCKET}" \
+                        --region "${AWS_REGION:-${REGION}}" \
+                        ${ADAPTER_ARG:+--adapter-name "${ADAPTER_ARG}"}; then
+                        echo "   ✅ Results persisted to Athena"
+                    else
+                        echo "   ⚠️  Athena write failed (non-fatal)"
+                    fi
+                fi
+            fi
+            ;;
+        InProgress|Starting|Pending)
+            echo ""
+            echo "   Job is still running. Check again with: ./do/benchmark --status"
+            ;;
+        Failed)
+            FAILURE_REASON=$(aws sagemaker describe-ai-benchmark-job \
+                --ai-benchmark-job-name "${JOB_NAME}" \
+                --region "${AWS_REGION}" \
+                --query 'FailureReason' \
+                --output text 2>/dev/null) || FAILURE_REASON="unknown"
+            echo "   Reason: ${FAILURE_REASON}"
+            ;;
+    esac
+    exit 0
+fi
+
+
 # ── Require --workload flag ───────────────────────────────────────────────────
 if [ -z "${ARG_WORKLOAD}" ]; then
     echo "❌ --workload <name> is required"
@@ -172,8 +292,11 @@ print(f's3://{bucket}/${PROJECT_NAME}/')
 
 CI_BENCHMARK_RESULTS_BUCKET=$(echo "${_PROFILE_JSON}" | python3 -c "import sys,json; print(json.load(sys.stdin).get('ciBenchmarkResultsBucket', ''))" 2>/dev/null) || CI_BENCHMARK_RESULTS_BUCKET=""
 
-# Derive job names at runtime (unique per invocation)
-BENCHMARK_JOB_NAME="${PROJECT_NAME}-benchmark-$(date +%Y%m%d-%H%M%S)"
+ROLE_ARN=$(echo "${_PROFILE_JSON}" | python3 -c "import sys,json; print(json.load(sys.stdin).get('roleArn', ''))" 2>/dev/null) || ROLE_ARN=""
+
+# Derive job names at runtime (unique per invocation).
+# Preserve BENCHMARK_JOB_NAME if already set (from do/config or env) for resume logic.
+BENCHMARK_JOB_NAME="${BENCHMARK_JOB_NAME:-${PROJECT_NAME}-benchmark-$(date +%Y%m%d-%H%M%S)}"
 BENCHMARK_WORKLOAD_CONFIG_NAME="${PROJECT_NAME}-benchmark-config-$(date +%Y%m%d-%H%M%S)"
 
 # Ensure benchmark params have defaults (in case workload catalog wasn't found)
@@ -228,7 +351,15 @@ if [ -n "${BENCHMARK_CONCURRENCY_LEVELS:-}" ] && [ -z "${_BENCHMARK_SINGLE_LEVEL
             if [ -n "${IC_ARG}" ]; then _REINVOKE_ARGS="${_REINVOKE_ARGS} --ic ${IC_ARG}"; fi
             if [ -n "${ADAPTER_ARG}" ]; then _REINVOKE_ARGS="${_REINVOKE_ARGS} --adapter ${ADAPTER_ARG}"; fi
 
-            if "${BASH_SOURCE[0]}" ${_REINVOKE_ARGS}; then
+            _CHILD_EXIT=0
+            "${BASH_SOURCE[0]}" ${_REINVOKE_ARGS} || _CHILD_EXIT=$?
+
+            if [ ${_CHILD_EXIT} -eq 130 ]; then
+                # Child was interrupted (Ctrl+C) — propagate cleanly
+                exit 130
+            fi
+
+            if [ ${_CHILD_EXIT} -eq 0 ]; then
                 # Copy results to aggregation directory — find the child's results
                 # Try the marker file first (set by child), then fall back to ls -td
                 _LATEST_JOB_DIR=""
@@ -427,7 +558,8 @@ print(f'Combined {n_metrics} concurrency level results')
                 --project-name "${PROJECT_NAME}" \
                 --workload "${BENCHMARK_WORKLOAD:-manual}" \
                 --bucket "${CI_BENCHMARK_RESULTS_BUCKET}" \
-                --region "${AWS_REGION:-${REGION}}"; then
+                --region "${AWS_REGION:-${REGION}}" \
+                ${ADAPTER_ARG:+--adapter-name "${ADAPTER_ARG}"}; then
                 echo "✅ Multi-level benchmark results persisted to S3"
             else
                 echo "⚠️  Failed to persist multi-level benchmark results to Athena (non-fatal)"
@@ -747,7 +879,10 @@ echo ""
 echo "⚙️  Step 1: Creating AI Workload Config: ${WORKLOAD_CONFIG_NAME}"
 
 # Build parameters block
-PARAMS_JSON="{\"prompt_input_tokens_mean\":${BENCHMARK_INPUT_TOKENS_MEAN},\"output_tokens_mean\":${BENCHMARK_OUTPUT_TOKENS_MEAN},\"concurrency\":${BENCHMARK_CONCURRENCY},\"streaming\":${BENCHMARK_STREAMING},\"tokenizer\":\"${MODEL_NAME}\""
+# Use HF_MODEL_ID for tokenizer (the original HuggingFace repo ID, e.g. "Qwen/Qwen3-0.6B").
+# MODEL_NAME may have been rewritten to an S3 URI by do/stage, which AIPerf can't use as a tokenizer source.
+BENCHMARK_TOKENIZER="${HF_MODEL_ID:-${MODEL_NAME}}"
+PARAMS_JSON="{\"prompt_input_tokens_mean\":${BENCHMARK_INPUT_TOKENS_MEAN},\"output_tokens_mean\":${BENCHMARK_OUTPUT_TOKENS_MEAN},\"concurrency\":${BENCHMARK_CONCURRENCY},\"streaming\":${BENCHMARK_STREAMING},\"tokenizer\":\"${BENCHMARK_TOKENIZER}\""
 
 # Add optional request_count if specified
 if [ -n "${BENCHMARK_REQUEST_COUNT:-}" ]; then
@@ -856,6 +991,18 @@ fi  # end of RESUME_EXISTING=false block
 # Skip polling if we already know the job completed (resumed a finished job)
 if [ "${JOB_STATUS:-}" != "Completed" ] && [ "${JOB_STATUS:-}" != "Failed" ] && [ "${JOB_STATUS:-}" != "Stopped" ]; then
 
+# Handle Ctrl+C during polling — exit cleanly without stopping the remote job.
+_handle_benchmark_interrupt() {
+    echo ""
+    echo ""
+    echo "⚠️  Interrupted — job continues running in background"
+    echo "   Job: ${BENCHMARK_JOB_NAME}"
+    echo ""
+    echo "   Check status:      aws sagemaker describe-ai-benchmark-job --ai-benchmark-job-name ${BENCHMARK_JOB_NAME} --region ${AWS_REGION}"
+    exit 130
+}
+trap '_handle_benchmark_interrupt' INT
+
 echo "⏳ Step 3: Waiting for benchmark to complete..."
 echo "   Polling every ${POLL_INTERVAL}s (max ${MAX_POLL_ATTEMPTS} attempts = 30 min)"
 echo ""
@@ -897,13 +1044,14 @@ while [ ${POLL_COUNT} -lt ${MAX_POLL_ATTEMPTS} ]; do
     esac
 done
 
+trap - INT
+
 # Check for timeout
 if [ ${POLL_COUNT} -ge ${MAX_POLL_ATTEMPTS} ]; then
     echo ""
     echo "⚠️  Benchmark timed out after 30 minutes (status: ${JOB_STATUS})"
-    echo "   The job may still be running. Re-run ./do/benchmark to resume waiting."
-    echo "   Or check status manually:"
-    echo "   aws sagemaker describe-ai-benchmark-job --ai-benchmark-job-name ${BENCHMARK_JOB_NAME} --region ${AWS_REGION}"
+    echo "   The job may still be running."
+    echo "   Check status: ./do/benchmark --status"
     exit 1
 fi
 
@@ -949,7 +1097,16 @@ if [ "${JOB_STATUS}" = "Completed" ]; then
             # Extract any tar.gz archives (benchmark service packages results as output.tar.gz)
             for ARCHIVE in $(find "${LOCAL_RESULTS_DIR}" -name "*.tar.gz" -type f 2>/dev/null); do
                 ARCHIVE_DIR=$(dirname "${ARCHIVE}")
-                tar -xzf "${ARCHIVE}" -C "${ARCHIVE_DIR}" 2>/dev/null || true
+                # Detect whether tar has a leading directory prefix to strip.
+                # Some AIPerf versions wrap in output/, others are flat.
+                _TAR_FIRST=$(tar -tzf "${ARCHIVE}" 2>/dev/null | head -1)
+                if echo "${_TAR_FIRST}" | grep -qE '^[^/]+/$'; then
+                    # Leading directory (e.g., "output/") — strip it
+                    tar -xzf "${ARCHIVE}" --strip-components=1 -C "${ARCHIVE_DIR}" 2>/dev/null || true
+                else
+                    # Flat archive — extract as-is
+                    tar -xzf "${ARCHIVE}" -C "${ARCHIVE_DIR}" 2>/dev/null || true
+                fi
             done
 
             # Look for specific result files (priority: JSONL > aiperf JSON)
@@ -1208,7 +1365,8 @@ except Exception as e:
             --workload "${BENCHMARK_WORKLOAD:-manual}" \
             --concurrency "${BENCHMARK_CONCURRENCY}" \
             --bucket "${CI_BENCHMARK_RESULTS_BUCKET}" \
-            --region "${AWS_REGION:-${REGION}}"; then
+            --region "${AWS_REGION:-${REGION}}" \
+            ${ADAPTER_ARG:+--adapter-name "${ADAPTER_ARG}"}; then
             echo "✅ Benchmark results persisted to S3"
         else
             echo "⚠️  Failed to persist benchmark results to Athena (non-fatal)"

package/templates/do/config

@@ -211,9 +211,32 @@ export <%= key %>=${<%= key %>:-<%= value %>}
 <% }); %>
 <% } %>
 
+<% if (typeof icEnvVars !== 'undefined' && icEnvVars && Object.keys(icEnvVars).length > 0) { %>
+# Deploy-time IC environment variables (applied at IC creation via SDK v3, not baked into image)
+# Max 16 vars, max 1024 chars per key/value
+# WARNING: Do not store raw secrets here. Use Secrets Manager ARN pattern instead:
+#   export IC_ENV_HF_TOKEN_ARN=arn:aws:secretsmanager:REGION:ACCOUNT:secret:NAME
+#   Runtime code resolves the ARN to the secret value (same pattern as HF_TOKEN_ARN in do/build).
+<% Object.entries(icEnvVars).forEach(([key, value]) => { %>
+export IC_ENV_<%= key %>=${IC_ENV_<%= key %>:-<%= value %>}
+<% }); %>
+<% } else if (deploymentTarget === 'realtime-inference') { %>
+# ─── Deploy-time IC environment variables (uncomment to configure) ─────────────
+# These are passed as the Environment field in InferenceComponent.create() at deploy time.
+# They do NOT affect the Docker build — build-time env vars remain in Dockerfile via ENV.
+# Max 16 vars, max 1024 chars per key/value.
+# WARNING: Do not store raw secrets here. Use Secrets Manager ARN pattern instead:
+#   export IC_ENV_HF_TOKEN_ARN=arn:aws:secretsmanager:REGION:ACCOUNT:secret:NAME
+# export IC_ENV_VLLM_MAX_MODEL_LEN=8192
+# export IC_ENV_VLLM_GPU_MEMORY_UTILIZATION=0.85
+<% } %>
+
 # Framework-specific configuration
 <% if (framework === 'transformers') { %>
 export MODEL_NAME="<%= modelName %>"
+# HuggingFace Model ID — preserved even after do/stage rewrites MODEL_NAME to S3.
+# Used by do/benchmark (tokenizer), do/tune (model catalog), and do/test (chat template).
+export HF_MODEL_ID="<%= modelName %>"
 # Secrets Manager integration: when an ARN is configured, do-scripts resolve the
 # secret at the appropriate stage (build-time or runtime). When a plaintext value
 # is configured, it is exported directly. The _ARN suffix signals resolution is needed.
@@ -253,6 +276,7 @@ export TUNE_MODEL_ID="<%= tuneModelId %>"
 
 <% if (framework === 'diffusors') { %>
 export MODEL_NAME="<%= modelName %>"
+export HF_MODEL_ID="<%= modelName %>"
 # Secrets Manager integration: when an ARN is configured, do-scripts resolve the
 # secret at the appropriate stage (build-time or runtime). When a plaintext value
 # is configured, it is exported directly. The _ARN suffix signals resolution is needed.

package/templates/do/lib/inference-component.sh

@@ -6,6 +6,50 @@
 #   PROJECT_NAME, ENDPOINT_NAME, ECR_REPOSITORY, AWS_REGION, CONTAINER_ENV_JSON
 # Also expects _update_config_var() to be available (from wait.sh).
 
+# _collect_ic_env_vars()
+#   Reads IC_ENV_* prefixed variables from the environment (sourced from do/config),
+#   strips the IC_ENV_ prefix, validates constraints, and outputs JSON key-value pairs.
+#   Constraints: max 16 entries, max 1024 chars per key/value.
+#   IC_ENV_* overrides take precedence over CONTAINER_ENV_JSON.
+#
+#   Sets IC_ENV_OVERRIDE in the caller's scope.
+_collect_ic_env_vars() {
+    IC_ENV_OVERRIDE=""
+    local ic_env_count=0
+
+    while IFS='=' read -r full_key value; do
+        # Skip empty lines
+        [ -z "${full_key}" ] && continue
+
+        local stripped_key="${full_key#IC_ENV_}"
+
+        # Validate key length (AC-3.4)
+        if [ ${#stripped_key} -gt 1024 ]; then
+            echo "⚠️  IC_ENV_${stripped_key}: key exceeds 1024 chars, skipping" >&2
+            continue
+        fi
+
+        # Validate value length (AC-3.4)
+        if [ ${#value} -gt 1024 ]; then
+            echo "⚠️  IC_ENV_${stripped_key}: value exceeds 1024 chars, skipping" >&2
+            continue
+        fi
+
+        ic_env_count=$((ic_env_count + 1))
+
+        # Max 16 env vars (AC-3.3)
+        if [ ${ic_env_count} -gt 16 ]; then
+            echo "⚠️  More than 16 IC_ENV_* variables defined. Using first 16 only." >&2
+            break
+        fi
+
+        if [ -n "${IC_ENV_OVERRIDE}" ]; then
+            IC_ENV_OVERRIDE="${IC_ENV_OVERRIDE},"
+        fi
+        IC_ENV_OVERRIDE="${IC_ENV_OVERRIDE}\"${stripped_key}\":\"${value}\""
+    done < <(env | grep "^IC_ENV_" | sort)
+}
+
 # create_inference_component <ic_config_file>
 #   Creates an inference component from a per-IC config file.
 #
@@ -17,6 +61,10 @@
 #     IC_STARTUP_TIMEOUT — container startup health check timeout in seconds (default: 900)
 #     IC_CONTAINER_ENV_EXTRA — optional extra env vars in "KEY":"value" format
 #
+#   IC_ENV_* prefixed vars from do/config are collected, validated, and passed
+#   as the Environment field in InferenceComponent.create() via SDK v3.
+#   Precedence: IC_ENV_* > IC_CONTAINER_ENV_EXTRA > CONTAINER_ENV_JSON
+#
 #   Multi-spec support (for heterogeneous instance pools):
 #     IC_MULTI_SPEC      — set to "true" to use Specifications (plural) array
 #     IC_SPEC_COUNT      — number of spec entries (e.g., 2)
@@ -38,6 +86,9 @@ create_inference_component() {
     # Source the IC config to get per-IC settings
     source "${ic_conf}"
 
+    # Collect IC_ENV_* overrides from environment (sourced from do/config)
+    _collect_ic_env_vars
+
     local ic_timestamp
     ic_timestamp=$(date +%s)
     local ic_basename
@@ -48,9 +99,11 @@ create_inference_component() {
     local container_spec="{\"Image\":\"${ECR_REPOSITORY}:${IC_IMAGE_TAG:-${PROJECT_NAME}-latest}\""
     # Always inject IC name for CW log forwarder
     local ic_env="\"INFERENCE_COMPONENT_NAME\":\"${ic_name}\""
-    if [ -n "${CONTAINER_ENV_JSON}${IC_CONTAINER_ENV_EXTRA:-}" ]; then
-        local env_json="${CONTAINER_ENV_JSON}"
-        [ -n "${IC_CONTAINER_ENV_EXTRA:-}" ] && env_json="${env_json:+${env_json},}${IC_CONTAINER_ENV_EXTRA}"
+    # Build environment JSON with precedence: IC_ENV_* > IC_CONTAINER_ENV_EXTRA > CONTAINER_ENV_JSON
+    local env_json="${CONTAINER_ENV_JSON}"
+    [ -n "${IC_CONTAINER_ENV_EXTRA:-}" ] && env_json="${env_json:+${env_json},}${IC_CONTAINER_ENV_EXTRA}"
+    [ -n "${IC_ENV_OVERRIDE:-}" ] && env_json="${env_json:+${env_json},}${IC_ENV_OVERRIDE}"
+    if [ -n "${env_json}" ]; then
         container_spec="${container_spec},\"Environment\":{${ic_env},${env_json}}"
     else
         container_spec="${container_spec},\"Environment\":{${ic_env}}"

package/templates/do/lib/profile.sh

@@ -44,5 +44,10 @@ except:
     fi
 fi
 
+# Map commonly-used profile values to the variable names scripts expect.
+# Explicit env vars take precedence (${X:-...} pattern).
+ROLE_ARN="${ROLE_ARN:-${_PROFILE_roleArn:-}}"
+CI_BENCHMARK_RESULTS_BUCKET="${CI_BENCHMARK_RESULTS_BUCKET:-${_PROFILE_ciBenchmarkResultsBucket:-}}"
+
 # NOTE: set -u is NOT re-enabled here. The caller is responsible for managing
 # their own shell options.