@aws/ml-container-creator 0.9.1 → 0.10.3

package/src/lib/bootstrap-command-handler.js

@@ -17,16 +17,17 @@
  */
 
 import { execSync } from 'node:child_process';
-import { existsSync, readFileSync, unlinkSync, writeFileSync, mkdirSync } from 'node:fs';
+import { existsSync, writeFileSync, mkdirSync } from 'node:fs';
 import path from 'node:path';
 import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import BootstrapConfig from './bootstrap-config.js';
 import AwsProfileParser from './aws-profile-parser.js';
-import AssetManager from './asset-manager.js';
 import McpCommandHandler from './mcp-command-handler.js';
 import RegistryCommandHandler from './registry-command-handler.js';
 import { runPrompts } from '../prompt-adapter.js';
+import BootstrapProfileManager from './bootstrap-profile-manager.js';
+import BootstrapProvisioners from './bootstrap-provisioners.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -39,16 +40,58 @@ export default class BootstrapCommandHandler {
         this.config = new BootstrapConfig();
         this.profileParser = new AwsProfileParser();
         this._promptFn = promptFn || runPrompts;
+        this.profileManager = new BootstrapProfileManager(this);
+        this.provisioners = new BootstrapProvisioners(this);
     }
 
+    // ── Provisioner delegations (backward compat for tests) ─────────
+
+    _buildResourceTags() { return this.provisioners._buildResourceTags(); }
+    _setupEcrRepository() { return this.provisioners._setupEcrRepository(); }
+    _setupIamRole(options) { return this.provisioners._setupIamRole(options); }
+    _setupS3Buckets() { return this.provisioners._setupS3Buckets(); }
+    _createS3Bucket(name, tags) { return this.provisioners._createS3Bucket(name, tags); }
+    _verifyCliV2() { return this.provisioners._verifyCliV2(); }
+
+    // ── ProfileManager delegations (backward compat for tests) ──────
+
+    _handleStatus(options) { return this.profileManager._handleStatus(options); }
+    _handleUse(profileName) { return this.profileManager._handleUse(profileName); }
+    _handleList() { return this.profileManager._handleList(); }
+    _handleRemove(profileName, options) { return this.profileManager._handleRemove(profileName, options); }
+    _handleScan() { return this.profileManager._handleScan(); }
+    _handlePrune() { return this.profileManager._handlePrune(); }
+    _handleSyncSchemas() { return this.profileManager._handleSyncSchemas(); }
+    _handleSyncModelFamilies() { return this.profileManager._handleSyncModelFamilies(); }
+
     /**
      * Dispatch bootstrap subcommands.
      * @param {string[]} args - Remaining positional args after 'bootstrap'
      * @param {object} options - Parsed CLI options
      */
     async handle(args, options) {
+        // Commander.js with passThroughOptions() captures flags after positional
+        // arguments in args rather than options. Extract known flags from args.
+        const extractedOptions = { ...options };
+        const cleanArgs = [];
+        for (const arg of args) {
+            if (arg === '--ci') extractedOptions.ci = true;
+            else if (arg === '--benchmark-infra') extractedOptions.benchmarkInfra = true;
+            else if (arg === '--skip-ci') extractedOptions.skipCi = true;
+            else if (arg === '--skip-s3') extractedOptions.skipS3 = true;
+            else if (arg === '--skip-post-setup') extractedOptions.skipPostSetup = true;
+            else if (arg === '--force') extractedOptions.force = true;
+            else if (arg === '--verify') extractedOptions.verify = true;
+            else if (arg === '--delete-stack') extractedOptions.deleteStack = true;
+            else if (arg === '--non-interactive') extractedOptions.nonInteractive = true;
+            else if (arg === '--ignore-staleness') extractedOptions.ignoreStaleness = true;
+            else cleanArgs.push(arg);
+        }
+        args = cleanArgs;
+        options = extractedOptions;
+
         // Handle legacy --sync-schemas flag for backward compatibility
-        if (options['sync-schemas']) {
+        if ((options['sync-schemas'] || options.syncSchemas)) {
             await this._handleSyncSchemas();
             if (args.length === 0) return;
         }
@@ -85,6 +128,15 @@ export default class BootstrapCommandHandler {
         case 'sync-schemas':
             await this._handleSyncSchemas();
             break;
+        case 'sync-model-families':
+            await this._handleSyncModelFamilies();
+            break;
+        // Migration path: upgrades legacy profiles to current naming conventions.
+        // Corrects stackName to mlcc-bootstrap-{profileName}, renames sharedStackFrom
+        // to sharedInfraFrom. Idempotent — safe to run multiple times.
+        case 'migrate':
+            await this._handleMigrate();
+            break;
         default:
             console.log(`Unknown bootstrap subcommand: ${subcommand}`);
             this._showHelp();
@@ -97,7 +149,8 @@ export default class BootstrapCommandHandler {
      * @param {object} options - Parsed CLI options
      */
     async _handleInteractiveSetup(options) {
-        const nonInteractive = options['non-interactive'];
+        // Commander.js converts --non-interactive to options.nonInteractive (camelCase)
+        const nonInteractive = options['non-interactive'] || options.nonInteractive;
 
         // Non-interactive mode: validate required flags upfront
         if (nonInteractive) {
@@ -117,7 +170,7 @@ export default class BootstrapCommandHandler {
         console.log('\n🚀 Bootstrap — Shared AWS Infrastructure Setup\n');
 
         // Verify AWS CLI v2 is installed
-        if (!this._verifyCliV2()) {
+        if (!this.provisioners._verifyCliV2()) {
             return;
         }
 
@@ -158,13 +211,13 @@ export default class BootstrapCommandHandler {
 
         // Step 3: Determine stack parameters
         let useExistingRoleArn = '';
-        if (nonInteractive && options['role-arn']) {
-            useExistingRoleArn = options['role-arn'];
-            console.log(`  Using provided IAM role ARN: ${options['role-arn']}`);
+        if (nonInteractive && (options['role-arn'] || options.roleArn)) {
+            useExistingRoleArn = (options['role-arn'] || options.roleArn);
+            console.log(`  Using provided IAM role ARN: ${(options['role-arn'] || options.roleArn)}`);
         }
 
         let createS3Buckets = false;
-        if (nonInteractive && options['skip-s3']) {
+        if (nonInteractive && (options['skip-s3'] || options.skipS3)) {
             console.log('  ⏭️  Skipping S3 bucket creation (--skip-s3)');
         } else if (nonInteractive) {
             createS3Buckets = true;
@@ -209,7 +262,8 @@ export default class BootstrapCommandHandler {
 
                 profileData.roleArn = stackOutputs.RoleArn;
                 profileData.ecrRepositoryName = stackOutputs.EcrRepositoryName;
-                profileData.stackName = otherStack;
+                profileData.stackName = stackName;
+                profileData.sharedInfraFrom = otherStack;  // Track that this profile reuses another's stack
                 if (stackOutputs.AsyncS3BucketName) profileData.asyncS3Bucket = stackOutputs.AsyncS3BucketName;
                 if (stackOutputs.BatchS3BucketName) profileData.batchS3Bucket = stackOutputs.BatchS3BucketName;
                 if (stackOutputs.AdapterS3BucketName) profileData.adapterS3Bucket = stackOutputs.AdapterS3BucketName;
@@ -223,15 +277,45 @@ export default class BootstrapCommandHandler {
         }
 
         if (!profileData.stackName) {
+            // Pre-check: if IAM role already exists globally (from another region's deployment),
+            // pass its ARN so CloudFormation skips re-creation (account-level singleton)
+            if (!useExistingRoleArn) {
+                try {
+                    const roleResult = this._execAws(
+                        'iam get-role --role-name mlcc-sagemaker-execution-role',
+                        awsProfile
+                    );
+                    const roleArn = roleResult && roleResult.Role && roleResult.Role.Arn;
+                    if (roleArn && roleArn.startsWith('arn:aws:iam::')) {
+                        useExistingRoleArn = roleArn;
+                        console.log(`  ℹ️  Reusing existing IAM role: ${roleArn}`);
+                    }
+                } catch (_) {
+                    // Role doesn't exist yet — will be created by the stack
+                }
+            }
+
             try {
+                // Check if ECR repo already exists (avoid ResourceExistenceCheck failure)
+                let skipEcr = 'false';
+                try {
+                    this._execAws(
+                        `ecr describe-repositories --repository-names ml-container-creator --region ${region}`,
+                        awsProfile
+                    );
+                    skipEcr = 'true';
+                    console.log('  ℹ️  ECR repository already exists — skipping creation');
+                } catch (_) { /* doesn't exist — will be created */ }
+
                 const stackOutputs = this._deployStack(stackName, {
                     CreateS3Buckets: createS3Buckets ? 'true' : 'false',
-                    UseExistingRoleArn: useExistingRoleArn
+                    UseExistingRoleArn: useExistingRoleArn,
+                    SkipEcrCreation: skipEcr
                 }, awsProfile, region);
 
                 // Read outputs into profile data
                 profileData.roleArn = stackOutputs.RoleArn;
-                profileData.ecrRepositoryName = stackOutputs.EcrRepositoryName;
+                profileData.ecrRepositoryName = stackOutputs.EcrRepositoryName || 'ml-container-creator';
                 profileData.stackName = stackName;
 
                 if (stackOutputs.AsyncS3BucketName) {
@@ -256,6 +340,23 @@ export default class BootstrapCommandHandler {
             }
         } // end if (!profileData.stackName)
 
+        // Step 4b: MLflow App for model customization experiment tracking
+        this._displayProgress('📊', 'MLflow App for experiment tracking...');
+        try {
+            if (!profileData.mlflowAppArn) {
+                const mlflowAppArn = this._ensureMlflowApp(profileData, awsProfile);
+                if (mlflowAppArn) {
+                    profileData.mlflowAppArn = mlflowAppArn;
+                    console.log(`  ✅ MLflow App ready: ${mlflowAppArn}`);
+                }
+            } else {
+                console.log(`  ✅ MLflow App already configured: ${profileData.mlflowAppArn}`);
+            }
+        } catch (error) {
+            console.log(`  ⚠️  MLflow App setup skipped: ${error.message}`);
+            console.log('     Tune jobs will still work but experiment tracking may not be available.');
+        }
+
         // Step 5: CI Infrastructure setup (separate CDK stack — unchanged)
         this._displayProgress('🧪', 'CI Testing Infrastructure...');
         try {
@@ -264,7 +365,7 @@ export default class BootstrapCommandHandler {
             if (nonInteractive) {
                 if (options.ci) {
                     provisionCi = true;
-                } else if (options['skip-ci']) {
+                } else if ((options['skip-ci'] || options.skipCi)) {
                     console.log('  ⏭️  Skipping CI infrastructure (--skip-ci)');
                     provisionCi = false;
                 } else {
@@ -281,6 +382,21 @@ export default class BootstrapCommandHandler {
             }
 
             if (provisionCi) {
+                // --- CI single-region enforcement ---
+                const ciConflict = this._findExistingCiProfile(profileName);
+                if (ciConflict) {
+                    console.log(`❌ CI infrastructure already deployed in region ${ciConflict.config.awsRegion} (profile: ${ciConflict.name}).`);
+                    console.log('   CI can only be deployed in one region per account.');
+                    provisionCi = false;
+                }
+            }
+
+            if (provisionCi) {
+                // Persist CI intent immediately so that `bootstrap update --ci` can
+                // retry if the CDK deploy fails. Don't wait for success.
+                profileData.ciInfraProvisioned = true;
+                profileData.ciTableName = profileData.ciTableName || 'mlcc-ci-table';
+
                 // Ensure CDK is bootstrapped in this account/region
                 const cdkBootstrapped = this._resourceExists(
                     `ssm get-parameter --name /cdk-bootstrap/hnb659fds/version --region ${profileData.awsRegion}`,
@@ -336,14 +452,25 @@ export default class BootstrapCommandHandler {
                         stdio: ['pipe', 'pipe', 'pipe']
                     });
 
+                    // Warn if shell AWS_REGION differs from profile region
+                    if (process.env.AWS_REGION && process.env.AWS_REGION !== profileData.awsRegion) {
+                        console.log(`  ⚠️  AWS_REGION env var (${process.env.AWS_REGION}) differs from profile region (${profileData.awsRegion}) — using profile region`);
+                    }
+
+                    // --no-rollback prevents rollback on AlreadyExists errors for IAM roles
+                    // that may pre-exist from a prior deployment or another region.
+                    const cdkDeployCmd = options.benchmarkInfra
+                        ? 'npx cdk deploy MlccCiHarnessStack --require-approval never --no-rollback --parameters MlccCiHarnessStack:CreateBenchmarkInfra=true'
+                        : 'npx cdk deploy MlccCiHarnessStack --require-approval never --no-rollback';
                     execSync(
-                        'npx cdk deploy MlccCiHarnessStack --require-approval never',
+                        cdkDeployCmd,
                         {
                             cwd: ciHarnessDir,
                             encoding: 'utf8',
                             stdio: 'inherit',
                             env: {
                                 ...process.env,
+                                AWS_REGION: profileData.awsRegion,
                                 CDK_DEFAULT_REGION: profileData.awsRegion,
                                 CDK_DEFAULT_ACCOUNT: profileData.accountId,
                                 AWS_PROFILE: profileData.awsProfile
@@ -354,6 +481,11 @@ export default class BootstrapCommandHandler {
 
                     profileData.ciInfraProvisioned = true;
                     profileData.ciTableName = 'mlcc-ci-table';
+                    if (options.benchmarkInfra) {
+                        profileData.benchmarkInfraProvisioned = true;
+                        profileData.ciGlueDatabase = 'mlcc_ci';
+                        profileData.ciBenchmarkResultsBucket = `mlcc-benchmark-results-${profileData.accountId}-${profileData.awsRegion}`;
+                    }
                 }
             }
         } catch (error) {
@@ -372,241 +504,325 @@ export default class BootstrapCommandHandler {
     }
 
     /**
-     * Display active bootstrap profile and resource state.
-     * @param {object} [options] - Parsed CLI options (e.g., --verify)
+     * Re-deploy bootstrap infrastructure using the active profile.
+     * No prompts — reads all config from the existing profile and re-applies
+     * the CloudFormation stack and optionally the CI CDK stack.
+     *
+     * @param {object} [options] - Parsed CLI options (e.g., --ci to force CI update)
      */
-    async _handleStatus(options = {}) {
-        const config = this.config.read();
-        if (!config) {
-            console.log('No bootstrap configuration found.');
-            console.log('Run `ml-container-creator bootstrap` to set up shared infrastructure.');
-            return;
-        }
-
+    async _handleUpdate(options = {}) {
         const profile = this.config.getActiveProfile();
         if (!profile) {
             console.log('No active bootstrap profile found.');
-            console.log('Run `ml-container-creator bootstrap` to set up shared infrastructure.');
+            console.log('Run `ml-container-creator bootstrap` to set up shared infrastructure first.');
             return;
         }
 
-        const allProfiles = this.config.listProfiles();
-        console.log(`\n📋 Active Profile: ${profile.name} (${allProfiles.length} profile${allProfiles.length === 1 ? '' : 's'} total)`);
-        console.log('─'.repeat(40));
+        const { name, config: profileConfig } = profile;
+        console.log(`\n🔄 Updating bootstrap infrastructure for profile "${name}"`);
+        console.log(`   Region: ${profileConfig.awsRegion}`);
+        console.log(`   Account: ${profileConfig.accountId}`);
 
-        for (const [key, value] of Object.entries(profile.config)) {
-            console.log(`  ${key}: ${value}`);
+        // --- SANITY CHECK 1: Account identity ---
+        const callerAccount = this._getCallerAccount(profileConfig.awsProfile);
+        if (callerAccount !== profileConfig.accountId) {
+            console.log(`❌ Account mismatch: profile expects ${profileConfig.accountId} but credentials resolve to ${callerAccount}`);
+            return;
         }
 
-        console.log('─'.repeat(40));
-
-        // Validate bootstrap stack
-        console.log('\n🔍 Resource Validation:');
-
-        const stackName = profile.config.stackName || `${STACK_NAME_PREFIX}-${profile.name}`;
+        // Re-deploy the CloudFormation bootstrap stack
+        const stackName = profileConfig.stackName || `${STACK_NAME_PREFIX}-${name}`;
 
-        try {
-            const stackInfo = this._execAws(
-                `cloudformation describe-stacks --stack-name ${stackName} --region ${profile.config.awsRegion}`,
-                profile.config.awsProfile
-            );
+        // Sanity check: stack name consistency (warn-and-continue)
+        const expectedStackName = `${STACK_NAME_PREFIX}-${name}`;
+        if (profileConfig.stackName && profileConfig.stackName !== expectedStackName) {
+            console.log(`⚠️  Stack name mismatch: expected "${expectedStackName}" but profile has "${profileConfig.stackName}"`);
+            console.log('   Run `ml-container-creator bootstrap migrate` to fix.');
+            console.log('   Proceeding with stored stack name...');
+        }
 
-            const stack = stackInfo.Stacks && stackInfo.Stacks[0];
-            if (stack) {
-                const status = stack.StackStatus;
-                const statusIcon = status === 'CREATE_COMPLETE' || status === 'UPDATE_COMPLETE' ? '✅' : '⚠️';
-                console.log(`  ${statusIcon} Bootstrap stack: ${stackName} (${status})`);
-
-                // Show stack outputs
-                const outputs = {};
-                for (const output of (stack.Outputs || [])) {
-                    outputs[output.OutputKey] = output.OutputValue;
-                }
+        // --- SANITY CHECK 3: Stack exists in target region ---
+        const stackExists = this._resourceExists(
+            `cloudformation describe-stacks --stack-name ${stackName} --region ${profileConfig.awsRegion}`,
+            profileConfig.awsProfile
+        );
+        if (!stackExists) {
+            console.log(`❌ Stack "${stackName}" not found in ${profileConfig.awsRegion}.`);
+            console.log('   Run `ml-container-creator bootstrap` to create it.');
+            return;
+        }
 
-                if (outputs.RoleArn) {
-                    console.log(`  ✅ IAM role: ${outputs.RoleArn.split('/').pop()}`);
-                }
-                if (outputs.EcrRepositoryName) {
-                    console.log(`  ✅ ECR repository: ${outputs.EcrRepositoryName}`);
-                }
-                if (outputs.AsyncS3BucketName) {
-                    console.log(`  ✅ S3 bucket (async): ${outputs.AsyncS3BucketName}`);
-                }
-                if (outputs.BatchS3BucketName) {
-                    console.log(`  ✅ S3 bucket (batch): ${outputs.BatchS3BucketName}`);
-                }
-                if (outputs.AdapterS3BucketName) {
-                    console.log(`  ✅ S3 bucket (adapters): ${outputs.AdapterS3BucketName}`);
-                }
-                if (outputs.BenchmarkS3BucketName) {
-                    console.log(`  ✅ S3 bucket (benchmark): ${outputs.BenchmarkS3BucketName}`);
-                }
-                if (outputs.StackVersion) {
-                    console.log(`  📋 Stack version: ${outputs.StackVersion}`);
-                }
+        // --- CI single-region enforcement ---
+        if (options.ci) {
+            const ciConflict = this._findExistingCiProfile(name);
+            if (ciConflict) {
+                console.log(`❌ CI infrastructure already deployed in region ${ciConflict.config.awsRegion} (profile: ${ciConflict.name}).`);
+                console.log('   CI can only be deployed in one region per account.');
+                return;
             }
-        } catch {
-            // Fall back to individual resource checks for profiles created before CloudFormation migration
-            console.log(`  ⚠️  Bootstrap stack "${stackName}" not found — checking resources individually`);
+        }
 
-            try {
-                const defaultRoleName = 'mlcc-sagemaker-execution-role';
-                let roleName = defaultRoleName;
-                if (profile.config.roleArn) {
-                    const arnParts = profile.config.roleArn.split('/');
-                    roleName = arnParts[arnParts.length - 1];
-                }
+        this._displayProgress('☁️', 'Updating bootstrap stack...');
 
-                const roleExists = this._resourceExists(
-                    `iam get-role --role-name ${roleName}`,
-                    profile.config.awsProfile
+        // Pre-check: if IAM role already exists globally (from another region's deployment),
+        // pass its ARN so CloudFormation skips re-creation (account-level singleton)
+        let useExistingRoleArn = profileConfig.roleArn || '';
+        if (!useExistingRoleArn) {
+            try {
+                const roleResult = this._execAws(
+                    'iam get-role --role-name mlcc-sagemaker-execution-role',
+                    profileConfig.awsProfile
                 );
-                if (roleExists) {
-                    console.log(`  ✅ IAM role: ${roleName}`);
-                } else {
-                    console.log(`  ⚠️  IAM role: ${roleName} — missing`);
+                const roleArn = roleResult && roleResult.Role && roleResult.Role.Arn;
+                if (roleArn && roleArn.startsWith('arn:aws:iam::')) {
+                    useExistingRoleArn = roleArn;
                 }
-            } catch {
-                console.log('  ⚠️  IAM role: could not validate');
+            } catch (_) {
+                // Role doesn't exist yet — will be created by the stack
             }
+        }
 
+        try {
+            // Check if ECR repo already exists (avoid ResourceExistenceCheck failure)
+            let skipEcr = 'false';
             try {
-                const ecrExists = this._resourceExists(
-                    `ecr describe-repositories --repository-names ml-container-creator --region ${profile.config.awsRegion}`,
-                    profile.config.awsProfile
+                this._execAws(
+                    `ecr describe-repositories --repository-names ml-container-creator --region ${profileConfig.awsRegion}`,
+                    profileConfig.awsProfile
                 );
-                if (ecrExists) {
-                    console.log('  ✅ ECR repository: ml-container-creator');
-                } else {
-                    console.log('  ⚠️  ECR repository: ml-container-creator — missing');
-                }
-            } catch {
-                console.log('  ⚠️  ECR repository: could not validate');
-            }
+                skipEcr = 'true';
+            } catch (_) { /* doesn't exist */ }
 
-            if (profile.config.asyncS3Bucket) {
-                try {
-                    const asyncExists = this._resourceExists(
-                        `s3api head-bucket --bucket ${profile.config.asyncS3Bucket}`,
-                        profile.config.awsProfile
-                    );
-                    console.log(asyncExists
-                        ? `  ✅ S3 bucket: ${profile.config.asyncS3Bucket}`
-                        : `  ⚠️  S3 bucket: ${profile.config.asyncS3Bucket} — missing`);
-                } catch {
-                    console.log(`  ⚠️  S3 bucket: ${profile.config.asyncS3Bucket} — could not validate`);
-                }
-            }
+            const stackOutputs = this._deployStack(stackName, {
+                CreateS3Buckets: (profileConfig.asyncS3Bucket || profileConfig.batchS3Bucket) ? 'true' : 'false',
+                UseExistingRoleArn: useExistingRoleArn,
+                SkipEcrCreation: skipEcr
+            }, profileConfig.awsProfile, profileConfig.awsRegion);
 
-            if (profile.config.batchS3Bucket) {
-                try {
-                    const batchExists = this._resourceExists(
-                        `s3api head-bucket --bucket ${profile.config.batchS3Bucket}`,
-                        profile.config.awsProfile
+            // Update profile with any new outputs
+            if (stackOutputs.RoleArn) profileConfig.roleArn = stackOutputs.RoleArn;
+            if (stackOutputs.EcrRepositoryName) profileConfig.ecrRepositoryName = stackOutputs.EcrRepositoryName;
+            if (stackOutputs.AsyncS3BucketName) profileConfig.asyncS3Bucket = stackOutputs.AsyncS3BucketName;
+            if (stackOutputs.BatchS3BucketName) profileConfig.batchS3Bucket = stackOutputs.BatchS3BucketName;
+            if (stackOutputs.BenchmarkS3BucketName) profileConfig.benchmarkS3Bucket = stackOutputs.BenchmarkS3BucketName;
+            profileConfig.stackName = stackName;
+
+            console.log('  ✅ Bootstrap stack updated');
+        } catch (error) {
+            console.log(`  ❌ Stack update failed: ${error.message}`);
+        }
+
+        // Re-deploy CI stack if it was provisioned or --ci flag is set
+        const shouldUpdateCi = profileConfig.ciInfraProvisioned || options.ci;
+        if (shouldUpdateCi) {
+            this._displayProgress('🧪', 'Updating CI harness stack...');
+
+            try {
+                const ciHarnessDir = path.resolve(__dirname, '../../infra/ci-harness');
+
+                // CI harness source is not bundled in the npm package — only available from git clone
+                if (!existsSync(ciHarnessDir)) {
+                    console.log('  ⏭️  CI harness source not available (npm install does not include infra/)');
+                    console.log('     To update the CI stack, run from a git clone: git clone https://github.com/awslabs/ml-container-creator && cd ml-container-creator && npx cdk deploy -c region=REGION');
+                } else {
+                    // Ensure dependencies are installed (handles cold starts / fresh clones)
+                    execSync('npm install --silent', {
+                        cwd: ciHarnessDir,
+                        encoding: 'utf8',
+                        stdio: ['pipe', 'pipe', 'pipe']
+                    });
+
+                    // --no-rollback prevents rollback on AlreadyExists errors for IAM roles
+                    // that may pre-exist from a prior deployment or another region.
+                    const updateCdkCmd = (options.benchmarkInfra || profileConfig.benchmarkInfraProvisioned)
+                        ? 'npx cdk deploy MlccCiHarnessStack --require-approval never --no-rollback --parameters MlccCiHarnessStack:CreateBenchmarkInfra=true'
+                        : 'npx cdk deploy MlccCiHarnessStack --require-approval never --no-rollback';
+                    execSync(
+                        updateCdkCmd,
+                        {
+                            cwd: ciHarnessDir,
+                            encoding: 'utf8',
+                            stdio: 'inherit',
+                            env: {
+                                ...process.env,
+                                AWS_REGION: profileConfig.awsRegion,
+                                CDK_DEFAULT_REGION: profileConfig.awsRegion,
+                                CDK_DEFAULT_ACCOUNT: profileConfig.accountId,
+                                AWS_PROFILE: profileConfig.awsProfile
+                            }
+                        }
                     );
-                    console.log(batchExists
-                        ? `  ✅ S3 bucket: ${profile.config.batchS3Bucket}`
-                        : `  ⚠️  S3 bucket: ${profile.config.batchS3Bucket} — missing`);
-                } catch {
-                    console.log(`  ⚠️  S3 bucket: ${profile.config.batchS3Bucket} — could not validate`);
+                    profileConfig.ciInfraProvisioned = true;
+                    profileConfig.ciGlueDatabase = profileConfig.ciGlueDatabase || 'mlcc_ci';
+                    profileConfig.ciBenchmarkResultsBucket = profileConfig.ciBenchmarkResultsBucket || `mlcc-benchmark-results-${profileConfig.accountId}-${profileConfig.awsRegion}`;
+                    console.log('  ✅ CI harness stack updated');
                 }
+            } catch (error) {
+                console.log(`  ❌ CI stack update failed: ${error.message}`);
             }
+        } else {
+            console.log('  ⏭️  CI stack skipped (not provisioned — use --ci to force)');
+        }
 
-            if (profile.config.benchmarkS3Bucket) {
-                try {
-                    const benchmarkExists = this._resourceExists(
-                        `s3api head-bucket --bucket ${profile.config.benchmarkS3Bucket}`,
-                        profile.config.awsProfile
-                    );
-                    console.log(benchmarkExists
-                        ? `  ✅ S3 bucket (benchmark): ${profile.config.benchmarkS3Bucket}`
-                        : `  ⚠️  S3 bucket (benchmark): ${profile.config.benchmarkS3Bucket} — missing`);
-                } catch {
-                    console.log(`  ⚠️  S3 bucket (benchmark): ${profile.config.benchmarkS3Bucket} — could not validate`);
-                }
+        // Ensure MLflow App exists
+        this._displayProgress('📊', 'MLflow App for experiment tracking...');
+        try {
+            const mlflowAppArn = this._ensureMlflowApp(profileConfig, profileConfig.awsProfile);
+            if (mlflowAppArn) {
+                profileConfig.mlflowAppArn = mlflowAppArn;
+                console.log(`  ✅ MLflow App ready: ${mlflowAppArn}`);
             }
+        } catch (error) {
+            console.log(`  ⚠️  MLflow App setup skipped: ${error.message}`);
         }
 
-        // Display deployed resources from manifest
-        console.log('\n📦 Deployed Resources:');
+        // Save updated profile
+        this.config.setProfile(name, profileConfig);
+        console.log(`\n✅ Update complete for profile "${name}"`);
 
-        const assetManager = new AssetManager(profile.name);
+        // Re-run post-setup chain after updating AWS resources
+        await this._runPostSetupChain(options);
+    }
 
-        if (!existsSync(assetManager.manifestPath)) {
-            console.log('  No deployment tracking data available.');
-            console.log('  Resources will be tracked after running deploy, push, or submit scripts.');
+    /**
+     * Migrate legacy profiles to current naming conventions.
+     * Corrects stackName mismatches and renames sharedStackFrom → sharedInfraFrom.
+     * Displays a preview of all changes and requires confirmation before writing.
+     */
+    async _handleMigrate() {
+        const config = this.config.read();
+        if (!config || !config.profiles) {
+            console.log('No profiles to migrate.');
             return;
         }
 
-        const resourcesByProject = assetManager.getResourcesByProject();
+        const changes = [];
+
+        for (const [name, profileConfig] of Object.entries(config.profiles)) {
+            const expected = `${STACK_NAME_PREFIX}-${name}`;
+
+            // Fix stackName mismatch
+            if (profileConfig.stackName && profileConfig.stackName !== expected) {
+                changes.push({
+                    profile: name,
+                    field: 'stackName',
+                    from: profileConfig.stackName,
+                    to: expected
+                });
+            }
+
+            // Rename sharedStackFrom → sharedInfraFrom
+            if (profileConfig.sharedStackFrom) {
+                changes.push({
+                    profile: name,
+                    field: 'sharedStackFrom → sharedInfraFrom',
+                    from: profileConfig.sharedStackFrom,
+                    to: profileConfig.sharedStackFrom
+                });
+            }
+        }
 
-        if (resourcesByProject.size === 0) {
-            console.log('  No deployed resources tracked.');
+        if (changes.length === 0) {
+            console.log('✅ All profiles already use current naming conventions.');
             return;
         }
 
-        for (const [project, resources] of resourcesByProject) {
-            console.log(`\n  Project: ${project}`);
-            for (const resource of resources) {
-                const timestamp = resource.createdAt || resource.lastUpdatedAt;
-                console.log(`    ${resource.resourceType}  ${resource.resourceId}  [${resource.status}]  ${timestamp}`);
-            }
+        // Display preview
+        console.log('📋 Migration Preview:\n');
+        for (const change of changes) {
+            console.log(`  Profile "${change.profile}":`);
+            console.log(`    ${change.field}: "${change.from}" → "${change.to}"`);
         }
 
-        const counts = assetManager.getStatusCounts();
-        console.log(`\n  Summary: ${counts.active} active, ${counts.deleted} deleted, ${counts.unknown} unknown`);
+        // Prompt for confirmation
+        const { confirm } = await this._promptFn([{
+            type: 'confirm',
+            name: 'confirm',
+            message: 'Apply these changes?',
+            default: true
+        }]);
+
+        if (!confirm) return;
 
-        // Drift detection if --verify flag is set
-        if (options.verify) {
-            await this._handleStatusVerify(profile, assetManager);
+        // Apply changes
+        for (const [name, profileConfig] of Object.entries(config.profiles)) {
+            const expected = `${STACK_NAME_PREFIX}-${name}`;
+            if (profileConfig.stackName !== expected) {
+                profileConfig.stackName = expected;
+            }
+            if (profileConfig.sharedStackFrom) {
+                profileConfig.sharedInfraFrom = profileConfig.sharedStackFrom;
+                delete profileConfig.sharedStackFrom;
+            }
         }
+
+        this.config.write(config);
+        console.log('✅ Migration complete.');
     }
 
     /**
-     * Perform drift detection for active resources.
-     * @param {object} profile - Active profile object with name and config
-     * @param {AssetManager} assetManager - AssetManager instance for the profile
+     * Run the post-setup chain: mcp init → registry sync-architectures → sync-schemas.
+     * Each step is independent — failures are collected and reported at the end.
+     *
+     * @param {object} options - Parsed CLI options (checks skipPostSetup)
      */
-    async _handleStatusVerify(profile, assetManager) {
-        console.log('\n🔎 Drift Detection:');
-
-        const activeResources = assetManager.listResources({ status: 'active' });
-
-        if (activeResources.length === 0) {
-            console.log('  No active resources to verify.');
+    async _runPostSetupChain(options = {}) {
+        if ((options['skip-post-setup'] || options.skipPostSetup)) {
+            console.log('\n⏭️  Skipping post-setup chain (--skip-post-setup)');
             return;
         }
 
-        let verified = 0;
-        let drifted = 0;
-        let unchecked = 0;
+        console.log('\n🔗 Running post-setup configuration...\n');
 
-        for (const resource of activeResources) {
-            const checkCommand = this._buildDriftCheckCommand(resource);
+        const failures = [];
 
-            if (!checkCommand) {
-                unchecked++;
-                continue;
-            }
+        // 1. MCP init — register bundled MCP servers
+        console.log('📡 Registering MCP servers...');
+        try {
+            const generatorAdapter = {
+                destinationPath(...segments) {
+                    return path.resolve(process.cwd(), ...segments);
+                }
+            };
+            const mcpHandler = new McpCommandHandler(generatorAdapter);
+            await mcpHandler.handle(['init'], {});
+        } catch (error) {
+            failures.push({ step: 'mcp init', error: error.message });
+            console.log(`  ⚠️  mcp init failed: ${error.message}`);
+        }
 
-            try {
-                const exists = this._resourceExists(checkCommand, profile.config.awsProfile);
+        // 2. Registry sync-architectures — populate supportedModelTypes
+        console.log('\n📋 Syncing model architecture registry...');
+        try {
+            const registryHandler = new RegistryCommandHandler();
+            await registryHandler.handle(['sync-architectures'], {});
+        } catch (error) {
+            failures.push({ step: 'registry sync-architectures', error: error.message });
+            console.log(`  ⚠️  registry sync-architectures failed: ${error.message}`);
+        }
 
-                if (exists) {
-                    verified++;
-                    console.log(`  ✅ ${resource.resourceType}: ${resource.resourceId}`);
-                } else {
-                    drifted++;
-                    assetManager.updateStatus(resource.resourceId, 'unknown');
-                    console.log(`  ⚠️  ${resource.resourceType}: ${resource.resourceId} — not found (status updated to unknown)`);
-                }
-            } catch {
-                unchecked++;
-                console.log(`  ⚠️  ${resource.resourceType}: ${resource.resourceId} — could not verify (credentials or API unavailable)`);
-            }
+        // 3. Schema sync — download AWS service models
+        console.log('\n📐 Syncing service schemas...');
+        try {
+            await this._handleSyncSchemas();
+        } catch (error) {
+            failures.push({ step: 'sync-schemas', error: error.message });
+            console.log(`  ⚠️  sync-schemas failed: ${error.message}`);
         }
 
-        console.log(`\n  Drift Summary: ${verified} verified, ${drifted} drifted, ${unchecked} unchecked`);
+        // Report results
+        if (failures.length === 0) {
+            console.log('\n✅ Bootstrap complete — all systems operational');
+        } else {
+            console.log(`\n⚠️  Bootstrap complete with ${failures.length} warning${failures.length === 1 ? '' : 's'}:`);
+            for (const { step, error } of failures) {
+                console.log(`  • ${step}: ${error}`);
+            }
+            console.log('\n  These steps can be re-run individually:');
+            console.log('    ml-container-creator mcp init');
+            console.log('    ml-container-creator registry sync-architectures');
+            console.log('    ml-container-creator bootstrap sync-schemas');
+        }
     }
 
     /**
@@ -631,7 +847,6 @@ export default class BootstrapCommandHandler {
             return `sagemaker describe-inference-component --inference-component-name ${name}`;
         }
         case 'ecr-image': {
-            // resourceId is a full image URI like 111111111111.dkr.ecr.us-east-1.amazonaws.com/repo:tag
             const parts = resourceId.split('/');
             const repoAndTag = parts[parts.length - 1];
             const [repo, tag] = repoAndTag.split(':');
@@ -652,573 +867,30 @@ export default class BootstrapCommandHandler {
 
     /**
      * Extract the resource name from an ARN.
-     * ARN format: arn:aws:service:region:account:resource-type/resource-name
      * @param {string} arn - AWS ARN string
      * @returns {string} The resource name portion
      */
     _extractNameFromArn(arn) {
-        // Handle ARN formats like:
-        // arn:aws:sagemaker:us-east-1:111111111111:endpoint/my-endpoint
-        // arn:aws:iam::111111111111:role/my-role
-        // arn:aws:codebuild:us-east-1:111111111111:project/my-project
         const parts = arn.split('/');
         return parts[parts.length - 1];
     }
 
     /**
-     * Switch the active bootstrap profile.
-     * @param {string} profileName - Profile name to activate
+     * Infer the resource type from an ARN.
+     * @param {string} arn - AWS ARN
+     * @returns {string|null} Resource type or null if not recognized
      */
-    async _handleUse(profileName) {
-        if (!profileName) {
-            console.log('Usage: ml-container-creator bootstrap use <profile>');
-            console.log('       ml-container-creator bootstrap use none    (deactivate)');
-            return;
-        }
-
-        if (profileName === 'none') {
-            this.config.setActiveProfile(null);
-            console.log('Active profile cleared. No bootstrap profile is active.');
-            return;
-        }
-
-        const profile = this.config.getProfile(profileName);
-        if (!profile) {
-            const available = this.config.listProfiles();
-            console.log(`Profile "${profileName}" not found.`);
-            if (available.length > 0) {
-                console.log(`Available profiles: ${available.join(', ')}`);
-            } else {
-                console.log('No profiles configured. Run `ml-container-creator bootstrap` to create one.');
-            }
-            return;
-        }
-
-        this.config.setActiveProfile(profileName);
-        console.log(`Switched active profile to "${profileName}".`);
-    }
-
-    /**
-     * List all bootstrap profiles.
-     */
-    async _handleList() {
-        const profiles = this.config.listProfiles();
-
-        if (profiles.length === 0) {
-            console.log('No bootstrap profiles configured.');
-            console.log('Run `ml-container-creator bootstrap` to set up shared infrastructure.');
-            return;
-        }
-
-        const config = this.config.read();
-        const activeProfileName = config ? config.activeProfile : null;
-
-        console.log('\nBootstrap Profiles:');
-        for (const name of profiles) {
-            if (name === activeProfileName) {
-                console.log(`  * ${name} (active)`);
-            } else {
-                console.log(`    ${name}`);
-            }
-        }
-    }
-
-    /**
-     * Remove a bootstrap profile.
-     * @param {string} profileName - Profile name to remove
-     * @param {object} options - Parsed CLI options (e.g., --force)
-     */
-    async _handleRemove(profileName, options) {
-        if (!profileName) {
-            console.log('Usage: ml-container-creator bootstrap remove <profile> [--force]');
-            return;
-        }
-
-        const profile = this.config.getProfile(profileName);
-        if (!profile) {
-            console.log(`Profile "${profileName}" not found.`);
-            return;
-        }
-
-        // Check for manifest file with active resources
-        const assetManager = new AssetManager(profileName);
-        const hasManifest = existsSync(assetManager.manifestPath);
-
-        if (hasManifest) {
-            const counts = assetManager.getStatusCounts();
-            if (counts.active > 0 && !options.force) {
-                console.log(`⚠️  Profile "${profileName}" has ${counts.active} active resource${counts.active === 1 ? '' : 's'} in the deployment manifest.`);
-            }
-        }
-
-        // Check for CloudFormation stack
-        const stackName = profile.stackName || `${STACK_NAME_PREFIX}-${profileName}`;
-        let hasStack = false;
-        try {
-            hasStack = this._resourceExists(
-                `cloudformation describe-stacks --stack-name ${stackName} --region ${profile.awsRegion}`,
-                profile.awsProfile
-            );
-        } catch {
-            // ignore
-        }
-
-        if (hasStack && !options.force) {
-            console.log(`⚠️  Profile "${profileName}" has a CloudFormation stack: ${stackName}`);
-            console.log('   Use --delete-stack to also delete the AWS resources, or --force to remove the profile only.');
-        }
-
-        if (!options.force) {
-            const { confirm } = await this._promptFn([{
-                type: 'confirm',
-                name: 'confirm',
-                message: `Remove bootstrap profile "${profileName}"?`,
-                default: false
-            }]);
-
-            if (!confirm) {
-                console.log('Removal cancelled.');
-                return;
-            }
-        }
-
-        // Delete CloudFormation stack if requested
-        if (hasStack && options['delete-stack']) {
-            try {
-                console.log(`🗑️  Deleting CloudFormation stack: ${stackName}`);
-                execSync(
-                    `aws cloudformation delete-stack --stack-name ${stackName} --region ${profile.awsRegion} --profile ${profile.awsProfile}`,
-                    { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
-                );
-                console.log('⏳ Waiting for stack deletion...');
-                execSync(
-                    `aws cloudformation wait stack-delete-complete --stack-name ${stackName} --region ${profile.awsRegion} --profile ${profile.awsProfile}`,
-                    { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
-                );
-                console.log(`✅ Stack "${stackName}" deleted.`);
-            } catch (err) {
-                console.log(`⚠️  Could not delete stack "${stackName}": ${err.message}`);
-                console.log('   You may need to delete it manually from the CloudFormation console.');
-            }
-        } else if (hasStack) {
-            console.log(`Note: CloudFormation stack "${stackName}" was left in place.`);
-            console.log('   To delete AWS resources, re-run with --delete-stack');
-        }
-
-        // Delete manifest file if it exists
-        if (hasManifest) {
-            try {
-                unlinkSync(assetManager.manifestPath);
-                console.log(`Manifest file for "${profileName}" deleted.`);
-            } catch {
-                console.log(`⚠️  Could not delete manifest file for "${profileName}".`);
-            }
-        }
-
-        this.config.removeProfile(profileName);
-        console.log(`Profile "${profileName}" removed.`);
-    }
-
-    /**
-     * Scan AWS for pre-existing MLCC-managed resources and add them to the manifest.
-     */
-    async _handleScan() {
-        const profile = this.config.getActiveProfile();
-        if (!profile) {
-            console.log('No active bootstrap profile found.');
-            console.log('Run `ml-container-creator bootstrap` to set up shared infrastructure.');
-            return;
-        }
-
-        console.log(`\n🔍 Scanning for pre-existing resources in ${profile.config.awsRegion}...`);
-
-        const assetManager = new AssetManager(profile.name);
-        const now = new Date().toISOString();
-        let discovered = 0;
-        let added = 0;
-        let skipped = 0;
-
-        // 1. Query Resource Groups Tagging API for mlcc:managed-by tagged resources
-        try {
-            console.log('\n  Checking tagged resources...');
-            const tagResult = this._execAws(
-                `resourcegroupstaggingapi get-resources --tag-filters Key=mlcc:managed-by,Values=ml-container-creator --region ${profile.config.awsRegion}`,
-                profile.config.awsProfile
-            );
-
-            const taggedResources = tagResult.ResourceTagMappingList || [];
-            for (const tagged of taggedResources) {
-                discovered++;
-                const arn = tagged.ResourceARN;
-                const existing = assetManager.getResource(arn);
-                if (existing) {
-                    skipped++;
-                    continue;
-                }
-
-                const resourceType = this._inferResourceTypeFromArn(arn);
-                if (!resourceType) {
-                    skipped++;
-                    continue;
-                }
-
-                const project = this._inferProjectFromTags(tagged.Tags) || 'unknown';
-
-                try {
-                    assetManager.addResource({
-                        resourceId: arn,
-                        resourceType,
-                        createdAt: now,
-                        lastUpdatedAt: now,
-                        project,
-                        status: 'active',
-                        metadata: { discoveredBy: 'scan' }
-                    });
-                    added++;
-                } catch {
-                    skipped++;
-                }
-            }
-        } catch {
-            console.log('  ⚠️  Could not query tagged resources (credentials or API unavailable)');
-        }
-
-        // 2. Query ECR for images in ml-container-creator repository
-        try {
-            console.log('  Checking ECR images...');
-            const ecrResult = this._execAws(
-                `ecr describe-images --repository-name ml-container-creator --region ${profile.config.awsRegion}`,
-                profile.config.awsProfile
-            );
-
-            const images = ecrResult.imageDetails || [];
-            for (const image of images) {
-                const tags = image.imageTags || [];
-                for (const tag of tags) {
-                    discovered++;
-                    const imageUri = `${profile.config.accountId}.dkr.ecr.${profile.config.awsRegion}.amazonaws.com/ml-container-creator:${tag}`;
-                    const existing = assetManager.getResource(imageUri);
-                    if (existing) {
-                        skipped++;
-                        continue;
-                    }
-
-                    try {
-                        assetManager.addResource({
-                            resourceId: imageUri,
-                            resourceType: 'ecr-image',
-                            createdAt: now,
-                            lastUpdatedAt: now,
-                            project: this._inferProjectFromImageTag(tag),
-                            status: 'active',
-                            metadata: {
-                                repositoryName: 'ml-container-creator',
-                                imageTag: tag,
-                                region: profile.config.awsRegion,
-                                discoveredBy: 'scan'
-                            }
-                        });
-                        added++;
-                    } catch {
-                        skipped++;
-                    }
-                }
-            }
-        } catch {
-            console.log('  ⚠️  Could not query ECR images (credentials or API unavailable)');
-        }
-
-        // 3. Query CodeBuild for *-build-* projects
-        try {
-            console.log('  Checking CodeBuild projects...');
-            const cbResult = this._execAws(
-                `codebuild list-projects --region ${profile.config.awsRegion}`,
-                profile.config.awsProfile
-            );
-
-            const projects = (cbResult.projects || []).filter(name => name.includes('-build-'));
-            for (const projectName of projects) {
-                discovered++;
-                const arn = `arn:aws:codebuild:${profile.config.awsRegion}:${profile.config.accountId}:project/${projectName}`;
-                const existing = assetManager.getResource(arn);
-                if (existing) {
-                    skipped++;
-                    continue;
-                }
-
-                try {
-                    assetManager.addResource({
-                        resourceId: arn,
-                        resourceType: 'codebuild-project',
-                        createdAt: now,
-                        lastUpdatedAt: now,
-                        project: this._inferProjectFromCodeBuildName(projectName),
-                        status: 'active',
-                        metadata: {
-                            projectName,
-                            region: profile.config.awsRegion,
-                            discoveredBy: 'scan'
-                        }
-                    });
-                    added++;
-                } catch {
-                    skipped++;
-                }
-            }
-        } catch {
-            console.log('  ⚠️  Could not query CodeBuild projects (credentials or API unavailable)');
-        }
-
-        // Display summary
-        console.log(`\n  Scan complete: ${discovered} discovered, ${added} added, ${skipped} skipped (duplicates or unsupported)`);
-
-        if (discovered === 0) {
-            console.log('  No MLCC-managed resources were discovered.');
-        }
-    }
-
-    /**
-     * Prune stale records from the manifest — removes entries with status
-     * 'deleted' or 'unknown' that are no longer useful.
-     */
-    async _handlePrune() {
-        const profile = this.config.getActiveProfile();
-        if (!profile) {
-            console.log('No active bootstrap profile found.');
-            return;
-        }
-
-        const assetManager = new AssetManager(profile.name);
-
-        if (!existsSync(assetManager.manifestPath)) {
-            console.log('No deployment tracking data to prune.');
-            return;
-        }
-
-        const before = assetManager.listResources();
-        const toRemove = before.filter(r => r.status === 'deleted' || r.status === 'unknown');
-
-        if (toRemove.length === 0) {
-            console.log('Nothing to prune — no deleted or unknown records found.');
-            return;
-        }
-
-        console.log(`\n🧹 Pruning ${toRemove.length} stale record${toRemove.length === 1 ? '' : 's'}:\n`);
-
-        for (const resource of toRemove) {
-            assetManager.removeResource(resource.resourceId);
-            console.log(`  🗑️  [${resource.status}] ${resource.resourceType}: ${resource.resourceId}`);
-        }
-
-        const after = assetManager.listResources();
-        console.log(`\n  Done. ${toRemove.length} removed, ${after.length} remaining.`);
-    }
-
-    /**
-     * Handle sync-schemas subcommand: download service models and verify AWS CLI.
-     */
-    async _handleSyncSchemas() {
-        console.log('\n📦 Schema Sync — Downloading AWS service models...\n');
-
-        // Verify AWS CLI is installed
-        try {
-            const version = execSync('aws --version', { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
-            console.log(`  AWS CLI: ${version}`);
-        } catch {
-            console.log('  ⚠️  AWS CLI not found.');
-            console.log('  Install: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html');
-            console.log('  Continuing without AWS CLI verification...\n');
-        }
-
-        // Dynamic import to avoid circular dependencies
-        const { syncSchemas } = await import('./schema-sync.js');
-        const result = await syncSchemas();
-
-        if (result.success) {
-            console.log('\n  ✅ Schema sync complete.');
-        } else {
-            console.log('\n  ⚠️  Schema sync completed with errors (some services may be unavailable).');
-        }
-
-        console.log(`  Manifest written: lastSynced = ${result.manifest.lastSynced}\n`);
-    }
-
-    /**
-     * Re-deploy bootstrap infrastructure using the active profile.
-     * No prompts — reads all config from the existing profile and re-applies
-     * the CloudFormation stack and optionally the CI CDK stack.
-     *
-     * @param {object} [options] - Parsed CLI options (e.g., --ci to force CI update)
-     */
-    async _handleUpdate(options = {}) {
-        const profile = this.config.getActiveProfile();
-        if (!profile) {
-            console.log('No active bootstrap profile found.');
-            console.log('Run `ml-container-creator bootstrap` to set up shared infrastructure first.');
-            return;
-        }
-
-        const { name, config: profileConfig } = profile;
-        console.log(`\n🔄 Updating bootstrap infrastructure for profile "${name}"`);
-        console.log(`   Region: ${profileConfig.awsRegion}`);
-        console.log(`   Account: ${profileConfig.accountId}`);
-
-        // Re-deploy the CloudFormation bootstrap stack
-        const stackName = profileConfig.stackName || `${STACK_NAME_PREFIX}-${name}`;
-        this._displayProgress('☁️', 'Updating bootstrap stack...');
-
-        try {
-            const stackOutputs = this._deployStack(stackName, {
-                CreateS3Buckets: (profileConfig.asyncS3Bucket || profileConfig.batchS3Bucket) ? 'true' : 'false',
-                UseExistingRoleArn: ''
-            }, profileConfig.awsProfile, profileConfig.awsRegion);
-
-            // Update profile with any new outputs
-            if (stackOutputs.RoleArn) profileConfig.roleArn = stackOutputs.RoleArn;
-            if (stackOutputs.EcrRepositoryName) profileConfig.ecrRepositoryName = stackOutputs.EcrRepositoryName;
-            if (stackOutputs.AsyncS3BucketName) profileConfig.asyncS3Bucket = stackOutputs.AsyncS3BucketName;
-            if (stackOutputs.BatchS3BucketName) profileConfig.batchS3Bucket = stackOutputs.BatchS3BucketName;
-            if (stackOutputs.BenchmarkS3BucketName) profileConfig.benchmarkS3Bucket = stackOutputs.BenchmarkS3BucketName;
-            profileConfig.stackName = stackName;
-
-            console.log('  ✅ Bootstrap stack updated');
-        } catch (error) {
-            console.log(`  ❌ Stack update failed: ${error.message}`);
-        }
-
-        // Re-deploy CI stack if it was provisioned or --ci flag is set
-        const shouldUpdateCi = profileConfig.ciInfraProvisioned || options.ci;
-        if (shouldUpdateCi) {
-            this._displayProgress('🧪', 'Updating CI harness stack...');
-
-            try {
-                const ciHarnessDir = path.resolve(__dirname, '../../infra/ci-harness');
-
-                // CI harness source is not bundled in the npm package — only available from git clone
-                if (!existsSync(ciHarnessDir)) {
-                    console.log('  ⏭️  CI harness source not available (npm install does not include infra/)');
-                    console.log('     To update the CI stack, run from a git clone: git clone https://github.com/awslabs/ml-container-creator && cd ml-container-creator && npx cdk deploy -c region=REGION');
-                } else {
-                    // Ensure dependencies are installed (handles cold starts / fresh clones)
-                    execSync('npm install --silent', {
-                        cwd: ciHarnessDir,
-                        encoding: 'utf8',
-                        stdio: ['pipe', 'pipe', 'pipe']
-                    });
-
-                    execSync(
-                        'npx cdk deploy MlccCiHarnessStack --require-approval never',
-                        {
-                            cwd: ciHarnessDir,
-                            encoding: 'utf8',
-                            stdio: 'inherit',
-                            env: {
-                                ...process.env,
-                                CDK_DEFAULT_REGION: profileConfig.awsRegion,
-                                CDK_DEFAULT_ACCOUNT: profileConfig.accountId,
-                                AWS_PROFILE: profileConfig.awsProfile
-                            }
-                        }
-                    );
-                    profileConfig.ciInfraProvisioned = true;
-                    console.log('  ✅ CI harness stack updated');
-                }
-            } catch (error) {
-                console.log(`  ❌ CI stack update failed: ${error.message}`);
-            }
-        } else {
-            console.log('  ⏭️  CI stack skipped (not provisioned — use --ci to force)');
-        }
-
-        // Save updated profile
-        this.config.setProfile(name, profileConfig);
-        console.log(`\n✅ Update complete for profile "${name}"`);
-
-        // Re-run post-setup chain after updating AWS resources
-        await this._runPostSetupChain(options);
-    }
-
-    /**
-     * Run the post-setup chain: mcp init → registry sync-architectures → sync-schemas.
-     * Each step is independent — failures are collected and reported at the end.
-     *
-     * @param {object} options - Parsed CLI options (checks skipPostSetup)
-     */
-    async _runPostSetupChain(options = {}) {
-        if (options['skip-post-setup']) {
-            console.log('\n⏭️  Skipping post-setup chain (--skip-post-setup)');
-            return;
-        }
-
-        console.log('\n🔗 Running post-setup configuration...\n');
-
-        const failures = [];
-
-        // 1. MCP init — register bundled MCP servers
-        console.log('📡 Registering MCP servers...');
-        try {
-            const generatorAdapter = {
-                destinationPath(...segments) {
-                    return path.resolve(process.cwd(), ...segments);
-                }
-            };
-            const mcpHandler = new McpCommandHandler(generatorAdapter);
-            await mcpHandler.handle(['init'], {});
-        } catch (error) {
-            failures.push({ step: 'mcp init', error: error.message });
-            console.log(`  ⚠️  mcp init failed: ${error.message}`);
-        }
-
-        // 2. Registry sync-architectures — populate supportedModelTypes
-        console.log('\n📋 Syncing model architecture registry...');
-        try {
-            const registryHandler = new RegistryCommandHandler();
-            await registryHandler.handle(['sync-architectures'], {});
-        } catch (error) {
-            failures.push({ step: 'registry sync-architectures', error: error.message });
-            console.log(`  ⚠️  registry sync-architectures failed: ${error.message}`);
-        }
-
-        // 3. Schema sync — download AWS service models
-        console.log('\n📐 Syncing service schemas...');
-        try {
-            await this._handleSyncSchemas();
-        } catch (error) {
-            failures.push({ step: 'sync-schemas', error: error.message });
-            console.log(`  ⚠️  sync-schemas failed: ${error.message}`);
-        }
-
-        // Report results
-        if (failures.length === 0) {
-            console.log('\n✅ Bootstrap complete — all systems operational');
-        } else {
-            console.log(`\n⚠️  Bootstrap complete with ${failures.length} warning${failures.length === 1 ? '' : 's'}:`);
-            for (const { step, error } of failures) {
-                console.log(`  • ${step}: ${error}`);
-            }
-            console.log('\n  These steps can be re-run individually:');
-            console.log('    ml-container-creator mcp init');
-            console.log('    ml-container-creator registry sync-architectures');
-            console.log('    ml-container-creator bootstrap sync-schemas');
-        }
-    }
-
-    /**
-     * Infer the resource type from an ARN.
-     * @param {string} arn - AWS ARN
-     * @returns {string|null} Resource type or null if not recognized
-     */
-    _inferResourceTypeFromArn(arn) {
-        if (arn.includes(':endpoint/')) return 'sagemaker-endpoint';
-        if (arn.includes(':endpoint-config/')) return 'sagemaker-endpoint-config';
-        if (arn.includes(':model/')) return 'sagemaker-model';
-        if (arn.includes(':inference-component/')) return 'sagemaker-inference-component';
-        if (arn.includes(':transform-job/')) return 'sagemaker-transform-job';
-        if (arn.includes(':project/')) return 'codebuild-project';
-        if (arn.includes(':role/')) return 'iam-role';
-        if (arn.includes(':topic')) return 'sns-topic';
-        return null;
-    }
+    _inferResourceTypeFromArn(arn) {
+        if (arn.includes(':endpoint/')) return 'sagemaker-endpoint';
+        if (arn.includes(':endpoint-config/')) return 'sagemaker-endpoint-config';
+        if (arn.includes(':model/')) return 'sagemaker-model';
+        if (arn.includes(':inference-component/')) return 'sagemaker-inference-component';
+        if (arn.includes(':transform-job/')) return 'sagemaker-transform-job';
+        if (arn.includes(':project/')) return 'codebuild-project';
+        if (arn.includes(':role/')) return 'iam-role';
+        if (arn.includes(':topic')) return 'sns-topic';
+        return null;
+    }
 
     /**
      * Infer the project name from resource tags.
@@ -1307,396 +979,9 @@ export default class BootstrapCommandHandler {
         return { accountId, region };
     }
 
-    /**
-     * Create or reuse the SageMaker execution IAM role.
-     * @param {object} options - Parsed CLI options
-     * @returns {Promise<string>} Role ARN
-     */
-    async _setupIamRole(_options) {
-        const roleName = 'mlcc-sagemaker-execution-role';
-
-        // Define trust policy for SageMaker
-        const trustPolicy = {
-            Version: '2012-10-17',
-            Statement: [
-                {
-                    Effect: 'Allow',
-                    Principal: {
-                        Service: 'sagemaker.amazonaws.com'
-                    },
-                    Action: 'sts:AssumeRole'
-                }
-            ]
-        };
-
-        // Define execution policy with least-privilege permissions
-        const executionPolicy = {
-            Version: '2012-10-17',
-            Statement: [
-                {
-                    Sid: 'SageMakerEndpoints',
-                    Effect: 'Allow',
-                    Action: [
-                        'sagemaker:CreateEndpoint',
-                        'sagemaker:CreateEndpointConfig',
-                        'sagemaker:CreateModel',
-                        'sagemaker:CreateInferenceComponent',
-                        'sagemaker:UpdateEndpoint',
-                        'sagemaker:UpdateEndpointWeightsAndCapacities',
-                        'sagemaker:UpdateInferenceComponent',
-                        'sagemaker:DeleteEndpoint',
-                        'sagemaker:DeleteEndpointConfig',
-                        'sagemaker:DeleteModel',
-                        'sagemaker:DeleteInferenceComponent',
-                        'sagemaker:DescribeEndpoint',
-                        'sagemaker:DescribeEndpointConfig',
-                        'sagemaker:DescribeModel',
-                        'sagemaker:DescribeInferenceComponent',
-                        'sagemaker:ListInferenceComponents',
-                        'sagemaker:InvokeEndpoint',
-                        'sagemaker:InvokeEndpointAsync'
-                    ],
-                    Resource: '*'
-                },
-                {
-                    Sid: 'SageMakerBenchmarking',
-                    Effect: 'Allow',
-                    Action: [
-                        'sagemaker:CreateAIBenchmarkJob',
-                        'sagemaker:DescribeAIBenchmarkJob',
-                        'sagemaker:ListAIBenchmarkJobs',
-                        'sagemaker:StopAIBenchmarkJob',
-                        'sagemaker:DeleteAIBenchmarkJob',
-                        'sagemaker:CreateAIWorkloadConfig',
-                        'sagemaker:DescribeAIWorkloadConfig',
-                        'sagemaker:ListAIWorkloadConfigs',
-                        'sagemaker:DeleteAIWorkloadConfig'
-                    ],
-                    Resource: '*'
-                },
-                {
-                    Sid: 'ECRPull',
-                    Effect: 'Allow',
-                    Action: [
-                        'ecr:GetAuthorizationToken',
-                        'ecr:BatchCheckLayerAvailability',
-                        'ecr:GetDownloadUrlForLayer',
-                        'ecr:BatchGetImage'
-                    ],
-                    Resource: 'arn:aws:ecr:*:*:repository/ml-container-creator'
-                },
-                {
-                    Sid: 'ECRAuth',
-                    Effect: 'Allow',
-                    Action: 'ecr:GetAuthorizationToken',
-                    Resource: '*'
-                },
-                {
-                    Sid: 'CloudWatchLogs',
-                    Effect: 'Allow',
-                    Action: [
-                        'logs:CreateLogGroup',
-                        'logs:CreateLogStream',
-                        'logs:PutLogEvents'
-                    ],
-                    Resource: 'arn:aws:logs:*:*:*'
-                },
-                {
-                    Sid: 'S3ModelRead',
-                    Effect: 'Allow',
-                    Action: [
-                        's3:GetObject',
-                        's3:PutObject',
-                        's3:AbortMultipartUpload',
-                        's3:ListBucket'
-                    ],
-                    Resource: [
-                        'arn:aws:s3:::ml-container-creator-*',
-                        'arn:aws:s3:::ml-container-creator-*/*'
-                    ]
-                },
-                {
-                    Sid: 'SNSPublish',
-                    Effect: 'Allow',
-                    Action: 'sns:Publish',
-                    Resource: 'arn:aws:sns:*:*:ml-container-creator-*'
-                },
-                {
-                    Sid: 'SecretsManagerBenchmark',
-                    Effect: 'Allow',
-                    Action: [
-                        'secretsmanager:CreateSecret',
-                        'secretsmanager:PutSecretValue',
-                        'secretsmanager:GetSecretValue',
-                        'secretsmanager:DescribeSecret'
-                    ],
-                    Resource: 'arn:aws:secretsmanager:*:*:secret:ml-container-creator/*'
-                },
-                {
-                    Sid: 'QuotaAndAvailability',
-                    Effect: 'Allow',
-                    Action: [
-                        'service-quotas:GetServiceQuota',
-                        'service-quotas:ListServiceQuotas',
-                        'sagemaker:ListTrainingPlans',
-                        'sagemaker:DescribeTrainingPlan',
-                        'sagemaker:ListEndpoints'
-                    ],
-                    Resource: '*'
-                }
-            ]
-        };
-
-        // Check if role already exists
-        const roleExists = this._resourceExists(
-            `iam get-role --role-name ${roleName}`,
-            this._currentProfile
-        );
-
-        if (roleExists) {
-            const existingRole = this._execAws(
-                `iam get-role --role-name ${roleName}`,
-                this._currentProfile
-            );
-            const roleArn = existingRole.Role.Arn;
-            console.log(`  ✅ IAM role "${roleName}" already exists — reused`);
-
-            // Always update the inline policy and tags to ensure they're current
-            try {
-                const execPolicyFile = this._writeJsonTempFile(executionPolicy, 'exec-policy');
-                this._execAws(
-                    `iam put-role-policy --role-name ${roleName} --policy-name mlcc-execution-policy --policy-document ${execPolicyFile}`,
-                    this._currentProfile
-                );
-                console.log('  ✅ IAM policy "mlcc-execution-policy" — updated');
-            } catch (err) {
-                console.log(`  ⚠️  Could not update inline policy: ${err.message}`);
-            }
-
-            try {
-                const tags = this._buildResourceTags();
-                this._execAws(
-                    `iam tag-role --role-name ${roleName} --tags ${this._formatTagsForCli(tags)}`,
-                    this._currentProfile
-                );
-                console.log('  ✅ IAM role tags — updated');
-            } catch (err) {
-                console.log(`  ⚠️  Could not update role tags: ${err.message}`);
-            }
-
-            return roleArn;
-        }
-
-        // Display policies to user before creation
-        console.log('\n  Trust Policy:');
-        console.log(JSON.stringify(trustPolicy, null, 2));
-        console.log('\n  Execution Policy:');
-        console.log(JSON.stringify(executionPolicy, null, 2));
-        console.log('');
-
-        try {
-            // Create the IAM role — write policy to temp file to avoid shell escaping issues
-            const trustPolicyFile = this._writeJsonTempFile(trustPolicy, 'trust-policy');
-            const createRoleResult = this._execAws(
-                `iam create-role --role-name ${roleName} --assume-role-policy-document ${trustPolicyFile}`,
-                this._currentProfile
-            );
-            const roleArn = createRoleResult.Role.Arn;
-
-            // Attach inline execution policy
-            const execPolicyFile = this._writeJsonTempFile(executionPolicy, 'exec-policy');
-            this._execAws(
-                `iam put-role-policy --role-name ${roleName} --policy-name mlcc-execution-policy --policy-document ${execPolicyFile}`,
-                this._currentProfile
-            );
-
-            // Apply resource tags
-            const tags = this._buildResourceTags();
-            this._execAws(
-                `iam tag-role --role-name ${roleName} --tags ${this._formatTagsForCli(tags)}`,
-                this._currentProfile
-            );
-
-            console.log(`  ✅ IAM role "${roleName}" — created`);
-            return roleArn;
-        } catch (error) {
-            const errorMessage = error.message || '';
-            if (errorMessage.includes('AccessDenied') || errorMessage.includes('UnauthorizedAccess')) {
-                console.log('  ⚠️  Permission denied for iam:CreateRole. Please provide an existing role ARN.');
-                const { roleArn } = await this._promptFn([{
-                    type: 'input',
-                    name: 'roleArn',
-                    message: 'Enter an existing IAM role ARN for SageMaker execution:'
-                }]);
-                return roleArn;
-            }
-            throw error;
-        }
-    }
-
-    /**
-     * Create or reuse the ECR repository.
-     * @returns {Promise<string>} ECR repository name
-     */
-    async _setupEcrRepository() {
-        const repoName = 'ml-container-creator';
-
-        // Check if repository already exists
-        const repoExists = this._resourceExists(
-            `ecr describe-repositories --repository-names ${repoName} --region ${this._currentRegion}`,
-            this._currentProfile
-        );
-
-        if (repoExists) {
-            console.log(`  ✅ ECR repository "${repoName}" already exists — reused`);
-            return repoName;
-        }
-
-        // Build resource tags
-        const tags = this._buildResourceTags();
-
-        // Create the ECR repository with image scanning and AES256 encryption
-        this._execAws(
-            `ecr create-repository --repository-name ${repoName} --image-scanning-configuration scanOnPush=true --encryption-configuration encryptionType=AES256 --region ${this._currentRegion} --tags ${this._formatTagsForCli(tags)}`,
-            this._currentProfile
-        );
-
-        // Apply lifecycle policy to expire untagged images after 30 days
-        const lifecyclePolicy = {
-            rules: [
-                {
-                    rulePriority: 1,
-                    description: 'Expire untagged images after 30 days',
-                    selection: {
-                        tagStatus: 'untagged',
-                        countType: 'sinceImagePushed',
-                        countUnit: 'days',
-                        countNumber: 30
-                    },
-                    action: {
-                        type: 'expire'
-                    }
-                }
-            ]
-        };
-
-        const lifecyclePolicyFile = this._writeJsonTempFile(lifecyclePolicy, 'ecr-lifecycle');
-        this._execAws(
-            `ecr put-lifecycle-policy --repository-name ${repoName} --lifecycle-policy-text ${lifecyclePolicyFile} --region ${this._currentRegion}`,
-            this._currentProfile
-        );
-
-        console.log(`  ✅ ECR repository "${repoName}" — created`);
-        return repoName;
-    }
-
-    /**
-     * Optionally create S3 buckets for async/batch deployments.
-     * Always creates the benchmark S3 bucket (unconditional).
-     * @returns {Promise<object|null>} Bucket names or null if skipped
-     */
-    async _setupS3Buckets() {
-        // Always create benchmark bucket (unconditional — avoids re-bootstrap when benchmarking is enabled later)
-        const benchmarkBucketName = `ml-container-creator-benchmark-${this._currentRegion}-${this._currentAccountId}`;
-        const tags = this._buildResourceTags();
-        const benchmarkS3Bucket = await this._createS3Bucket(benchmarkBucketName, tags);
-
-        const { useS3 } = await this._promptFn([{
-            type: 'confirm',
-            name: 'useS3',
-            message: 'Will you use async inference or batch transform?',
-            default: false
-        }]);
-
-        if (!useS3) {
-            return { benchmarkS3Bucket };
-        }
-
-        const asyncBucketName = `ml-container-creator-async-${this._currentRegion}-${this._currentAccountId}`;
-        const batchBucketName = `ml-container-creator-batch-${this._currentRegion}-${this._currentAccountId}`;
-
-        const asyncS3Bucket = await this._createS3Bucket(asyncBucketName, tags);
-        const batchS3Bucket = await this._createS3Bucket(batchBucketName, tags);
-
-        return { asyncS3Bucket, batchS3Bucket, benchmarkS3Bucket };
-    }
-
-    /**
-     * Create or reuse a single S3 bucket with versioning, encryption, and tags.
-     * @param {string} bucketName - S3 bucket name
-     * @param {Array<{Key: string, Value: string}>} tags - Resource tags
-     * @returns {Promise<string>} Bucket name
-     */
-    async _createS3Bucket(bucketName, tags) {
-        // Check if bucket already exists
-        const bucketExists = this._resourceExists(
-            `s3api head-bucket --bucket ${bucketName}`,
-            this._currentProfile
-        );
-
-        if (bucketExists) {
-            console.log(`  ✅ S3 bucket "${bucketName}" already exists — reused`);
-            return bucketName;
-        }
-
-        // Build create-bucket command with region-appropriate configuration
-        let createCommand = `s3api create-bucket --bucket ${bucketName} --region ${this._currentRegion}`;
-        if (this._currentRegion !== 'us-east-1') {
-            createCommand += ` --create-bucket-configuration LocationConstraint=${this._currentRegion}`;
-        }
-
-        this._execAws(createCommand, this._currentProfile);
-
-        // Enable versioning
-        this._execAws(
-            `s3api put-bucket-versioning --bucket ${bucketName} --versioning-configuration Status=Enabled`,
-            this._currentProfile
-        );
-
-        // Enable AES256 server-side encryption
-        const encryptionConfig = { Rules: [{ ApplyServerSideEncryptionByDefault: { SSEAlgorithm: 'AES256' } }] };
-        const encryptionFile = this._writeJsonTempFile(encryptionConfig, 's3-encryption');
-        this._execAws(
-            `s3api put-bucket-encryption --bucket ${bucketName} --server-side-encryption-configuration ${encryptionFile}`,
-            this._currentProfile
-        );
-
-        // Apply resource tags
-        const tagging = { TagSet: tags };
-        const taggingFile = this._writeJsonTempFile(tagging, 's3-tagging');
-        this._execAws(
-            `s3api put-bucket-tagging --bucket ${bucketName} --tagging ${taggingFile}`,
-            this._currentProfile
-        );
-
-        console.log(`  ✅ S3 bucket "${bucketName}" — created`);
-        return bucketName;
-    }
 
     // ── AWS CLI helpers ─────────────────────────────────────────────
 
-    /**
-     * Verify AWS CLI v2 is installed. Returns true if v2 is detected, false otherwise.
-     * Extracted as a method so tests can override it.
-     * @returns {boolean}
-     */
-    _verifyCliV2() {
-        try {
-            const versionOutput = execSync('aws --version', { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
-            if (!versionOutput.includes('aws-cli/2')) {
-                console.log(`  ❌ AWS CLI v2 is required. Detected: ${versionOutput.split(' ')[0]}`);
-                console.log('  Install: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html');
-                console.log('  Some features (benchmarking, newer SageMaker APIs) require CLI v2.\n');
-                return false;
-            }
-            return true;
-        } catch {
-            console.log('  ❌ AWS CLI not found.');
-            console.log('  Install: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html\n');
-            return false;
-        }
-    }
-
     /**
      * Execute an AWS CLI command and return parsed JSON output.
      * @param {string} command - AWS CLI command (without 'aws' prefix)
@@ -1716,6 +1001,12 @@ export default class BootstrapCommandHandler {
     /**
      * Deploy the bootstrap CloudFormation stack and return its outputs.
      *
+     * Before deploying, checks for pre-existing S3 buckets that would cause
+     * ResourceExistenceCheck failures. If the stack is in REVIEW_IN_PROGRESS
+     * state (empty shell from a failed prior attempt), deletes it first.
+     * If buckets exist but aren't managed by the stack, uses a CloudFormation
+     * import changeset to adopt them before proceeding with the normal deploy.
+     *
      * Uses `aws cloudformation deploy` which is idempotent — it creates the
      * stack on first run and updates it on subsequent runs. If the template
      * hasn't changed, it exits with "No changes to deploy" which we handle
@@ -1728,6 +1019,9 @@ export default class BootstrapCommandHandler {
      * @returns {object} Map of output key → output value
      */
     _deployStack(stackName, parameters, profile, region) {
+        // Handle ghost stacks and pre-existing resources
+        this._resolveStackConflicts(stackName, parameters, profile, region);
+
         // Build parameter overrides string
         const paramOverrides = Object.entries(parameters)
             .map(([key, value]) => `${key}=${value}`)
@@ -1751,6 +1045,32 @@ export default class BootstrapCommandHandler {
             const stderr = error.stderr || error.message || '';
             if (stderr.includes('No changes to deploy')) {
                 console.log('  ℹ️  Stack is up to date — no changes needed');
+            } else if (stderr.includes('ResourceExistenceCheck')) {
+                // Resources already exist outside the stack — attempt import and retry
+                console.log('  ⚠️  Pre-existing resources detected — attempting import...');
+                this._resolveStackConflicts(stackName, parameters, profile, region);
+                // Rebuild deploy command with updated parameters (e.g., CreateS3Buckets may now be 'false')
+                const retryParamOverrides = Object.entries(parameters)
+                    .map(([key, value]) => `${key}=${value}`)
+                    .join(' ');
+                const retryDeployCommand = [
+                    'aws cloudformation deploy',
+                    `--template-file ${STACK_TEMPLATE_PATH}`,
+                    `--stack-name ${stackName}`,
+                    '--capabilities CAPABILITY_NAMED_IAM',
+                    `--parameter-overrides ${retryParamOverrides}`,
+                    `--profile ${profile}`,
+                    `--region ${region}`
+                ].join(' ');
+                // Retry the deploy after import
+                try {
+                    execSync(retryDeployCommand, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+                } catch (retryError) {
+                    const retryStderr = retryError.stderr || retryError.message || '';
+                    if (!retryStderr.includes('No changes to deploy')) {
+                        throw retryError;
+                    }
+                }
             } else {
                 throw error;
             }
@@ -1772,9 +1092,144 @@ export default class BootstrapCommandHandler {
             outputs[output.OutputKey] = output.OutputValue;
         }
 
+        // If S3 buckets already existed (skipped creation), inject their names
+        // into outputs so the profile config gets populated correctly.
+        if (this._preExistingBuckets && this._preExistingBuckets.length > 0) {
+            const bucketOutputMap = {
+                'AsyncS3Bucket': 'AsyncS3BucketName',
+                'BatchS3Bucket': 'BatchS3BucketName',
+                'AdapterS3Bucket': 'AdapterS3BucketName',
+                'BenchmarkS3Bucket': 'BenchmarkS3BucketName',
+                'TuneS3Bucket': 'TuneS3BucketName'
+            };
+            for (const bucket of this._preExistingBuckets) {
+                const outputKey = bucketOutputMap[bucket.logicalId];
+                if (outputKey && !outputs[outputKey]) {
+                    outputs[outputKey] = bucket.name;
+                }
+            }
+            this._preExistingBuckets = null;
+        }
+
         return outputs;
     }
 
+    /**
+     * Resolve stack conflicts before deploying.
+     *
+     * Handles two scenarios that cause ResourceExistenceCheck failures:
+     * 1. Ghost stacks (REVIEW_IN_PROGRESS) — delete them first
+     * 2. Pre-existing S3 buckets not managed by the stack — import them
+     *
+     * @param {string} stackName - CloudFormation stack name
+     * @param {object} parameters - Stack parameter key-value pairs
+     * @param {string} profile - AWS CLI profile name
+     * @param {string} region - AWS region
+     */
+    _resolveStackConflicts(stackName, parameters, profile, region) {
+        // Check if stack exists and its status
+        let stackStatus = null;
+        let managedResources = [];
+
+        try {
+            const describeResult = this._execAws(
+                `cloudformation describe-stacks --stack-name ${stackName} --region ${region}`,
+                profile
+            );
+            const stack = describeResult.Stacks && describeResult.Stacks[0];
+            if (stack) {
+                stackStatus = stack.StackStatus;
+            }
+        } catch (_) {
+            // Stack doesn't exist — no conflicts possible
+            return;
+        }
+
+        // Handle ghost stacks (created but never successfully deployed)
+        if (stackStatus === 'REVIEW_IN_PROGRESS') {
+            console.log('  ⚠️  Found ghost stack (REVIEW_IN_PROGRESS) — deleting before redeploy...');
+            try {
+                execSync(
+                    `aws cloudformation delete-stack --stack-name ${stackName} --profile ${profile} --region ${region}`,
+                    { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
+                );
+                execSync(
+                    `aws cloudformation wait stack-delete-complete --stack-name ${stackName} --profile ${profile} --region ${region}`,
+                    { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 60000 }
+                );
+                console.log('  ✅ Ghost stack deleted');
+            } catch (err) {
+                console.log(`  ⚠️  Could not delete ghost stack: ${err.message || err}`);
+            }
+            // Don't return — fall through to check for pre-existing S3 buckets
+            // that need to be imported on the fresh deploy. The ghost stack had
+            // DeletionPolicy:Retain buckets that survive stack deletion.
+            stackStatus = null;
+            managedResources = [];
+        }
+
+        // For active stacks (or post-ghost-deletion), check if S3 buckets exist but aren't managed
+        if (parameters.CreateS3Buckets !== 'true') {
+            return; // Not creating buckets — no conflict
+        }
+
+        // Get list of resources currently managed by the stack (empty if stack was just deleted)
+        if (stackStatus) {
+            try {
+                const resources = this._execAws(
+                    `cloudformation list-stack-resources --stack-name ${stackName} --region ${region}`,
+                    profile
+                );
+                managedResources = (resources.StackResourceSummaries || [])
+                    .map(r => r.LogicalResourceId);
+            } catch (_) {
+                // Stack doesn't exist or can't be queried — proceed with empty managedResources
+            }
+        }
+
+        // Check each S3 bucket that the template would create
+        const accountId = this._currentAccountId;
+        const bucketConfigs = [
+            { logicalId: 'AsyncS3Bucket', name: `mlcc-async-${accountId}-${region}` },
+            { logicalId: 'BatchS3Bucket', name: `mlcc-batch-${accountId}-${region}` },
+            { logicalId: 'AdapterS3Bucket', name: `mlcc-adapters-${accountId}-${region}` },
+            { logicalId: 'BenchmarkS3Bucket', name: `mlcc-benchmark-${accountId}-${region}` },
+            { logicalId: 'TuneS3Bucket', name: `mlcc-tune-${accountId}-${region}` }
+        ];
+
+        const bucketsToImport = [];
+
+        for (const bucket of bucketConfigs) {
+            if (managedResources.includes(bucket.logicalId)) {
+                continue; // Already managed by the stack — no conflict
+            }
+            // Check if bucket exists in AWS
+            try {
+                execSync(
+                    `aws s3api head-bucket --bucket ${bucket.name} --profile ${profile} --region ${region}`,
+                    { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] }
+                );
+                // Bucket exists but not in stack — needs import
+                bucketsToImport.push(bucket);
+            } catch (_) {
+                // Bucket doesn't exist — will be created normally
+            }
+        }
+
+        if (bucketsToImport.length > 0) {
+            console.log(`  ℹ️  ${bucketsToImport.length} pre-existing S3 bucket(s) detected — skipping S3 creation (buckets already exist)`);
+
+            // Pre-existing S3 buckets survive stack deletion (DeletionPolicy: Retain).
+            // Rather than fighting CloudFormation's IMPORT limitations, just skip S3
+            // creation and wire the existing bucket names into the profile config directly.
+            // The naming convention is deterministic, so we know exactly what they are.
+            this._preExistingBuckets = bucketsToImport;
+
+            // Modify the parameters to skip S3 bucket creation in the deploy
+            parameters.CreateS3Buckets = 'false';
+        }
+    }
+
     /**
      * Write a JSON object to a temp file and return the `file://` path.
      * Used for passing complex JSON to AWS CLI commands without shell escaping issues.
@@ -1808,20 +1263,123 @@ export default class BootstrapCommandHandler {
         }
     }
 
-    // ── Tag helpers ─────────────────────────────────────────────────
+    /**
+     * Get the AWS account ID from the caller's credentials.
+     * Uses `sts get-caller-identity` to resolve the actual account.
+     *
+     * @param {string} awsProfile - AWS CLI profile name
+     * @returns {string} The 12-digit AWS account ID
+     */
+    _getCallerAccount(awsProfile) {
+        const identity = this._execAws('sts get-caller-identity', awsProfile);
+        return identity.Account;
+    }
+
+    /**
+     * Scan all profiles to find one with ciInfraProvisioned=true,
+     * excluding the given profile name.
+     *
+     * @param {string} excludeProfile - Profile name to exclude from the scan
+     * @returns {{ name: string, config: Object }|null} The CI profile, or null if none found
+     */
+    _findExistingCiProfile(excludeProfile) {
+        const config = this.config.read();
+        if (!config || !config.profiles) return null;
+
+        for (const [name, profileConfig] of Object.entries(config.profiles)) {
+            if (name === excludeProfile) continue;
+            if (profileConfig.ciInfraProvisioned) {
+                return { name, config: profileConfig };
+            }
+        }
+        return null;
+    }
 
     /**
-     * Build the standard resource tag set.
-     * @returns {Array<{Key: string, Value: string}>} Tag array
+     * Ensure an MLCC-owned MLflow App exists for experiment tracking.
+     * Creates one if it doesn't exist, using the tune S3 bucket as artifact store.
+     *
+     * @param {object} profileData - Bootstrap profile data (needs roleArn, awsRegion, accountId)
+     * @param {string} awsProfile - AWS CLI profile name
+     * @returns {string|null} MLflow App ARN or null if creation failed
      */
-    _buildResourceTags() {
-        const packageJsonPath = path.resolve(__dirname, '../../package.json');
-        const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
-        return [
-            { Key: 'mlcc:managed-by', Value: 'ml-container-creator' },
-            { Key: 'mlcc:created-by', Value: 'bootstrap' },
-            { Key: 'mlcc:version', Value: packageJson.version }
-        ];
+    _ensureMlflowApp(profileData, awsProfile) {
+        const region = profileData.awsRegion;
+        const accountId = profileData.accountId;
+        const roleArn = profileData.roleArn;
+        const appName = 'mlcc-tune-tracking';
+        const artifactBucket = `mlcc-tune-${accountId}-${region}`;
+
+        // Check if MLCC app already exists
+        try {
+            const apps = this._execAws(
+                `sagemaker list-mlflow-apps --region ${region}`,
+                awsProfile
+            );
+            const summaries = apps.Summaries || [];
+            const existing = summaries.find(a => a.Name === appName);
+            if (existing) {
+                return existing.Arn;
+            }
+        } catch {
+            // list-mlflow-apps may not be available in all CLI versions — proceed to create
+        }
+
+        // Create the MLflow App
+        console.log(`  Creating MLflow App "${appName}" with artifact store s3://${artifactBucket}...`);
+
+        // Ensure the artifact bucket exists (it's the tune bucket from the stack)
+        try {
+            this._execAws(
+                `s3api head-bucket --bucket ${artifactBucket} --region ${region}`,
+                awsProfile
+            );
+        } catch {
+            // Bucket doesn't exist — create it
+            console.log(`  Creating artifact bucket: ${artifactBucket}`);
+            try {
+                this._execAws(
+                    `s3api create-bucket --bucket ${artifactBucket} --region ${region} --create-bucket-configuration LocationConstraint=${region}`,
+                    awsProfile
+                );
+            } catch (bucketErr) {
+                // May already exist or region doesn't need LocationConstraint (us-east-1)
+                if (!bucketErr.message?.includes('BucketAlreadyOwnedByYou')) {
+                    try {
+                        this._execAws(
+                            `s3api create-bucket --bucket ${artifactBucket} --region ${region}`,
+                            awsProfile
+                        );
+                    } catch {
+                        // Bucket likely exists, continue
+                    }
+                }
+            }
+        }
+
+        // Create the app
+        try {
+            const result = this._execAws(
+                `sagemaker create-mlflow-app --name ${appName} --artifact-store-uri s3://${artifactBucket} --role-arn ${roleArn} --model-registration-mode AutoModelRegistrationEnabled --region ${region}`,
+                awsProfile
+            );
+            return result.Arn;
+        } catch (err) {
+            // If app already exists (race condition), try to describe it
+            if (err.message?.includes('ResourceLimitExceeded') || err.message?.includes('already exists')) {
+                try {
+                    const apps = this._execAws(
+                        `sagemaker list-mlflow-apps --region ${region}`,
+                        awsProfile
+                    );
+                    const found = (apps.Summaries || []).find(a => a.Name === appName);
+                    if (found) return found.Arn;
+                } catch {
+                    // Fall through
+                }
+            }
+            throw err;
+        }
     }
 
     /**
@@ -1861,6 +1419,8 @@ SUBCOMMANDS:
   scan                                Discover pre-existing MLCC-managed resources in AWS
   prune                               Remove deleted and unknown records from the deployment manifest
   update                              Re-deploy bootstrap stacks using active profile (no prompts)
+  migrate                             Upgrade legacy profiles to current naming conventions
+  sync-model-families                 Discover tune-eligible models from JumpStart Hub and update catalog
 
 SETUP OPTIONS:
   --non-interactive                   Run without interactive prompts
@@ -1889,6 +1449,8 @@ EXAMPLES:
   ml-container-creator bootstrap remove dev
   ml-container-creator bootstrap remove dev --force --delete-stack
   ml-container-creator bootstrap scan
+  ml-container-creator bootstrap sync-model-families
+  ml-container-creator bootstrap migrate
   ml-container-creator bootstrap --non-interactive --profile my-aws-profile --region us-west-2
   ml-container-creator bootstrap --non-interactive --profile my-aws-profile --role-arn arn:aws:iam::123456789012:role/MyRole --skip-s3
   ml-container-creator bootstrap --non-interactive --profile my-aws-profile --region us-west-2 --ci