tribunal-kit 9.2.1 → 9.2.4

package/.agents/skills/hf-cloud-python-env-setup/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: hf-cloud-python-env-setup
+description: 'Set up an isolated Python environment for SageMaker / AWS work, with the right Python version and current boto3. Use this skill whenever Python code will be executed for a SageMaker deployment, training job, or any AWS automation — including when about to run `pip install`, when about to invoke `boto3`, when creating or activating a virtualenv, or when the user asks to "set up the environment". Never use system Python and never `pip install` into it. Always isolate. This skill prevents the most common failure modes: wrong Python version, dependency conflicts, and stale SDKs.'
+---
+
+# Python Environment Setup for SageMaker
+
+Most SageMaker deployment failures that look like AWS problems are actually Python environment problems: wrong Python version, broken dependency resolution, stale SDK that doesn't know about a current API. This skill makes env setup boring and correct.
+
+## Core rules
+
+1. **Never use the system Python.** Always work inside an isolated environment.
+2. **Pin the Python version, not the package versions.** Use 3.10, 3.11, or 3.12. Avoid 3.13+ — ML libraries lag on wheel availability and dependency resolution breaks in confusing ways.
+3. **Install the latest of each package.** Don't defensively pin `boto3` or `awscli`. Newer ones have current API surfaces and security fixes. Only pin if the user explicitly requires a specific version.
+4. **Check installed versions correctly.** Use `importlib.metadata.version("package-name")`, never `module.__version__`. The latter is inconsistent across packages.
+5. **The bundled scripts use `boto3` directly.** The SageMaker Python SDK is a valid alternative — see "boto3 vs the SageMaker SDK" below.
+
+## boto3 vs the SageMaker SDK
+
+The bundled deploy scripts (`deploy.py`, `deploy_async.py`, `teardown.py`) use `boto3` directly and read image URIs from [AWS's published Deep Learning Containers catalog](https://aws.github.io/deep-learning-containers/reference/available_images/). That fits this workflow's explicit-stages design — each skill produces a concrete value (region, role ARN, image URI) that the next one consumes — and `boto3` is the stable underlying API client.
+
+The SageMaker Python SDK (v3) is fine to use when the user prefers it or their project already does. Since [PR #5960](https://github.com/aws/sagemaker-python-sdk/pull/5960) (June 2026), `ModelBuilder` auto-routes HuggingFace models to the current containers (text-generation → HuggingFace vLLM, multimodal → vLLM-Omni, embeddings → TEI). Don't avoid the SDK over stale-image or wrong-container concerns — that routing is fixed.
+
+Two specific SDK cases that still need care:
+
+- **Generative rerankers**: the SDK routes the `text-ranking` task to TEI unconditionally, which is wrong for causal-LM rerankers like Qwen3-Reranker — those need vLLM (see `hf-cloud-serving-image-selection`). Pass the container explicitly for these models.
+- **SSO assumed-role credentials**: v3 has had credential-resolution regressions in `ModelTrainer` / `FrameworkProcessor` under SSO profiles. If SDK calls fail with credential errors while `aws sts get-caller-identity` succeeds in the same shell, suspect this rather than your AWS config.
+
+If you use the SDK, install it into the isolated env like everything else (`.venv/bin/python -m pip install sagemaker`). The bundled scripts don't require it.
+
+## How to set up
+
+The fastest path is the bundled script — it's Python, so it runs the same on Windows, macOS, and Linux:
+
+```bash
+python3 scripts/setup_env.py        # macOS / Linux
+python  scripts/setup_env.py        # Windows (PowerShell / cmd)
+```
+
+This script detects `uv` and uses it if available (faster), falls back to the stdlib `venv` module, creates `.venv/` with Python 3.12 (override: `python3 setup_env.py .venv 3.11`), refuses unsupported Python versions, installs from the bundled `requirements.txt`, and is idempotent. It also prints the correct interpreter path for the host OS (see below).
+
+Manual equivalent:
+
+```bash
+# Preferred: uv
+uv venv --python 3.12 .venv
+uv pip install --python .venv/bin/python --upgrade boto3 awscli   # Windows: .venv\Scripts\python.exe
+
+# Fallback: stdlib venv
+python3.12 -m venv .venv
+.venv/bin/python -m pip install --upgrade pip boto3 awscli
+```
+
+After setup, **invoke the env's Python explicitly** rather than activating the venv. The interpreter path differs by platform:
+
+```bash
+.venv/bin/python deploy.py            # macOS / Linux
+.venv\Scripts\python.exe deploy.py    # Windows
+```
+
+This works the same in scripts, interactive shells, and agent tool calls. The rest of this skill writes `.venv/bin/python` for brevity — on Windows substitute `.venv\Scripts\python.exe`.
+
+## Verifying
+
+```bash
+.venv/bin/python scripts/check_versions.py
+```
+
+Prints versions of `boto3`, `botocore`, `awscli`. Uses `importlib.metadata.version()` so it works on every package, including ones without `__version__`. Pass arbitrary names: `... check_versions.py transformers huggingface_hub`.
+
+## Deployment-specific extras
+
+Default `requirements.txt` covers SageMaker orchestration. Some deployments need extras (`huggingface_hub` for model inspection, `transformers` for tokenizer validation). Add these to a deployment-specific requirements file in the project, install with the env's Python, don't pin unless there's a reason.
+
+## Common pitfalls
+
+**Mysterious `pip install` resolution errors**
+Almost always Python 3.13+ trying to install packages without wheels yet, or installing into a polluted system Python. Recreate at 3.12: delete `.venv` and re-run `python3 setup_env.py .venv 3.12` (the script recreates the env when the version doesn't match, so you can also just re-run it).
+
+**`pip install` succeeded but the script says "module not found"**
+You installed into a different interpreter than the one running the script. Always invoke Python explicitly: `.venv/bin/python -m pip install ...` and `.venv/bin/python deploy.py`.
+
+**Inline `python -c "..."` one-liners fail in PowerShell**
+PowerShell's quoting rules mangle nested/escaped quotes in inline Python. Don't debug the quoting — write the snippet to a small `.py` file and run that. (All bundled helpers are files for exactly this reason.)
+
+**boto3 call fails with "unknown parameter"**
+Your boto3 is older than the API surface. Upgrade with `.venv/bin/python -m pip install --upgrade boto3`. Don't downgrade the script to match an old version.
+
+**`sagemaker` (the SDK) installed but the bundled scripts fail**
+The bundled scripts don't use the SDK — they only need `boto3`/`awscli` from `requirements.txt`. Installing `sagemaker` alongside is harmless, but it doesn't replace the requirements install.

package/.agents/skills/hf-cloud-python-env-setup/requirements.txt

@@ -0,0 +1,17 @@
+# Core AWS dependencies for SageMaker deployment.
+#
+# No version pins. We want the latest of each — if scripts break against the
+# latest, fix the script, not the version. Newer boto3/awscli have current
+# API surfaces and security fixes.
+#
+# We do NOT depend on the SageMaker Python SDK (sagemaker / sagemaker-core /
+# sagemaker-serve). The deployment scripts call boto3 directly, and image URIs
+# are read from AWS's published catalog page rather than resolved via the SDK.
+# See hf-cloud-python-env-setup SKILL.md ("Why no SageMaker SDK").
+#
+# Add per-deployment extras (huggingface_hub for model inspection, transformers
+# for tokenizer validation) to a deployment-specific requirements file alongside
+# this one. Do not pin versions here unless you have a documented reason.
+
+boto3
+awscli

package/.agents/skills/hf-cloud-python-env-setup/scripts/check_versions.py

@@ -0,0 +1,29 @@
+#!/usr/bin/env python
+"""Report installed versions of key dependencies.
+
+Uses importlib.metadata.version() (works for every installed package, unlike
+the inconsistently-defined `module.__version__`).
+
+Usage:
+    python check_versions.py
+    python check_versions.py boto3 botocore transformers
+"""
+
+import sys
+from importlib.metadata import PackageNotFoundError, version
+
+DEFAULT_PACKAGES = ["boto3", "botocore", "awscli"]
+
+
+def main() -> int:
+    packages = sys.argv[1:] if len(sys.argv) > 1 else DEFAULT_PACKAGES
+    for pkg in packages:
+        try:
+            print(f"{pkg}=={version(pkg)}")
+        except PackageNotFoundError:
+            print(f"{pkg}: NOT INSTALLED")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/.agents/skills/hf-cloud-python-env-setup/scripts/setup_env.py

@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""Create an isolated Python environment for SageMaker work. Cross-platform.
+
+Idempotent. Prefers uv, falls back to the stdlib venv module.
+
+Handles the platform difference in venv layout: the interpreter lives at
+`<venv>/bin/python` on macOS/Linux and `<venv>\\Scripts\\python.exe` on Windows.
+The path it prints is the correct one for the host OS.
+
+Usage:
+    python setup_env.py [VENV_DIR=.venv] [PYTHON_VERSION=3.12]
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+# 3.10-3.12 is the safe zone for modern boto3 + awscli. 3.13+ may work but ML
+# libs lag on wheel availability.
+SUPPORTED_MIN = (3, 10)
+SUPPORTED_MAX = (3, 12)
+
+IS_WINDOWS = os.name == "nt"
+
+
+def log(msg: str) -> None:
+    print(f"[setup_env] {msg}", file=sys.stderr, flush=True)
+
+
+def parse_version(v: str) -> tuple[int, int]:
+    try:
+        major, minor = (int(p) for p in v.split(".")[:2])
+        return (major, minor)
+    except ValueError:
+        log(f"ERROR: invalid Python version '{v}' (expected e.g. 3.12)")
+        sys.exit(1)
+
+
+def venv_python(venv_dir: Path) -> Path:
+    """Path to the interpreter inside a venv, per platform."""
+    if IS_WINDOWS:
+        return venv_dir / "Scripts" / "python.exe"
+    return venv_dir / "bin" / "python"
+
+
+def interpreter_version(python_path: Path) -> str | None:
+    if not python_path.exists():
+        return None
+    proc = subprocess.run(
+        [str(python_path), "-c",
+         "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')"],
+        capture_output=True, text=True,
+    )
+    return proc.stdout.strip() if proc.returncode == 0 else None
+
+
+def find_base_python(version: str) -> str | None:
+    """Locate a base interpreter for the requested version for `python -m venv`."""
+    # Try `pythonX.Y` (Unix) / `pythonX.Y.exe`, then the Windows `py` launcher.
+    candidate = shutil.which(f"python{version}")
+    if candidate:
+        return candidate
+    if IS_WINDOWS and shutil.which("py"):
+        probe = subprocess.run(["py", f"-{version}", "--version"], capture_output=True, text=True)
+        if probe.returncode == 0:
+            return f"py -{version}"  # sentinel; expanded by caller
+    return None
+
+
+def main() -> int:
+    venv_dir = Path(sys.argv[1]) if len(sys.argv) > 1 else Path(".venv")
+    python_version = sys.argv[2] if len(sys.argv) > 2 else "3.12"
+
+    ver = parse_version(python_version)
+    if not (SUPPORTED_MIN <= ver <= SUPPORTED_MAX):
+        lo = ".".join(map(str, SUPPORTED_MIN))
+        hi = ".".join(map(str, SUPPORTED_MAX))
+        log(f"ERROR: Python {python_version} outside supported range {lo}-{hi}")
+        log("Use 3.10, 3.11, or 3.12.")
+        return 1
+
+    installer = "uv" if shutil.which("uv") else "venv"
+    if installer == "venv":
+        log("uv not found — falling back to python + venv. Consider: https://docs.astral.sh/uv/")
+
+    py = venv_python(venv_dir)
+
+    # Reuse existing env only if Python version matches.
+    current = interpreter_version(py)
+    if current == python_version:
+        log(f"Env exists at {venv_dir} with Python {current} — reusing")
+    else:
+        if current is not None:
+            log(f"Env at {venv_dir} uses Python {current} (wanted {python_version}) — recreating")
+            shutil.rmtree(venv_dir)
+
+        if installer == "uv":
+            uv = shutil.which("uv")
+            if subprocess.run([uv, "venv", "--python", python_version, str(venv_dir)]).returncode != 0:
+                log("ERROR: `uv venv` failed.")
+                return 1
+        else:
+            base = find_base_python(python_version)
+            if not base:
+                log(f"ERROR: python{python_version} not found on PATH.")
+                log("Install via pyenv/asdf/brew/system package manager, the Windows installer, or install uv.")
+                return 1
+            base_cmd = base.split() if base.startswith("py ") else [base]
+            if subprocess.run([*base_cmd, "-m", "venv", str(venv_dir)]).returncode != 0:
+                log("ERROR: `python -m venv` failed.")
+                return 1
+        log(f"Created env at {venv_dir}")
+
+    requirements = Path(__file__).resolve().parent.parent / "requirements.txt"
+    if not requirements.is_file():
+        log(f"ERROR: requirements.txt not found at {requirements}")
+        return 1
+
+    log(f"Installing from {requirements}")
+    if installer == "uv":
+        uv = shutil.which("uv")
+        rc = subprocess.run(
+            [uv, "pip", "install", "--python", str(py), "--upgrade", "-r", str(requirements)]
+        ).returncode
+    else:
+        subprocess.run([str(py), "-m", "pip", "install", "--upgrade", "pip"])
+        rc = subprocess.run(
+            [str(py), "-m", "pip", "install", "--upgrade", "-r", str(requirements)]
+        ).returncode
+    if rc != 0:
+        log("ERROR: dependency install failed.")
+        return 1
+
+    log(f"Done. Invoke directly: {py} <script>")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/.agents/skills/hf-cloud-sagemaker-deployment-planner/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: hf-cloud-sagemaker-deployment-planner
+description: 'Plan and coordinate the deployment of a model to Amazon SageMaker AI. Use this skill whenever the user wants to deploy, host, serve, or expose a model on SageMaker or AWS — including phrases like "deploy a model", "host this LLM on AWS", "serve this embedding model", "deploy a reranker", "deploy a text-to-image / diffusion model", "host this for async inference", "create an endpoint", "serve my fine-tuned model", or any request that involves making a model available for inference on AWS. Use this even when the user is vague (e.g. "I just want to get this running on AWS, you figure it out"). Works for text-generation LLMs, embedding models, rerankers, classifiers, text-to-image / diffusion models — picks the right serving stack and chooses between real-time and async inference. This is the entry-point skill for SageMaker deployment work — it asks clarifying questions, picks a deployment pathway, and coordinates the other deployment skills.'
+---
+
+# SageMaker Deployment Planner
+
+You are helping a user deploy a model to Amazon SageMaker. Most users invoking this skill want the model deployed with reasonable defaults, in as few questions as possible. Ask only what you need, recommend a pathway honestly, and hand off to the specialized skills.
+
+## Workflow phases
+
+1. **Discovery** — what is being deployed and what are the constraints (this skill)
+2. **Pathway selection** — real-time / serverless / async / batch / Bedrock CMI (this skill)
+3. **Context preflight** — `hf-cloud-aws-context-discovery`, then `hf-cloud-python-env-setup`
+4. **IAM preflight** — `hf-cloud-sagemaker-iam-preflight`
+5. **Image selection** — `hf-cloud-serving-image-selection`
+6. **Deployment** — `hf-cloud-sagemaker-production-defaults`
+
+Phases 1–2 are this skill's job. The others activate when their patterns match.
+
+## Discovery: ask only what you need
+
+You will eventually need to know:
+
+- **What model**: HuggingFace ID, S3 path to artifacts, or model name. If the user is vague ("the model I fine-tuned"), ask for the artifact location.
+- **Model type**: text-generation LLM, embedding/reranker, or other (classifier, NER, etc.). This determines the serving stack — usually inferable from the model name (anything ending in `-embed-*`, starting with `BAAI/bge-`, `sentence-transformers/*` etc. is embeddings; chat/instruct models are LLMs). Only ask if it's genuinely ambiguous.
+- **Traffic shape**: roughly how often will this be called?
+- **Latency tolerance**: interactive, near-real-time, or async?
+- **Cost sensitivity**: ask only if the user signals it or the traffic pattern is ambiguous.
+
+Region comes from `hf-cloud-aws-context-discovery` — don't ask unless the user volunteers it.
+
+Do **not** front-load all of these. A common minimal set is just: *what model, and roughly how often will it be called?* The model name usually settles the model-type question. That alone is often enough to narrow the pathway to two candidates. If the user already told you something, don't ask again.
+
+## Pathway selection
+
+| Pathway | When it fits | When it does not |
+|---|---|---|
+| **Real-time endpoint** | Steady traffic, sub-second to few-second latency, always-on | Very spiky or very sparse traffic (wastes money on idle) |
+| **Real-time, scale to zero** | Sparse or scheduled traffic, dev/test endpoints, and a client that tolerates a ~9 min first request after idle | Any interactive SLA: every request during the wake fails with a 400 |
+| **Serverless inference** | Spiky/intermittent, tolerates cold starts (~10s+), simpler models | LLMs above a few B params (memory/cold-start limits), strict SLAs |
+| **Async inference** | Long inference (>60s), large payloads, queue-friendly | Interactive synchronous calls |
+| **Batch transform** | Offline scoring over a dataset | Anything online or interactive |
+| **Bedrock Custom Model Import** | Wants Bedrock-compatible API, supported base family, weights only | Custom inference logic, unsupported architectures |
+
+For LLMs, **real-time endpoints are the default** unless traffic is explicitly spiky/sparse or inference is long-running. Serverless looks attractive for "low traffic" cases but most LLMs exceed its memory limits.
+
+For **embeddings**, real-time is again the default — but CPU instances are usually the right choice (much cheaper, fast enough for most embedding workloads). Don't reflexively recommend GPU instances for embedding models; ask `hf-cloud-serving-image-selection` to consider CPU variants if the model is small (<1B params) and traffic is moderate.
+
+For **text-to-image, video generation, or other long-inference workloads** (>30s per request) where traffic is also bursty: async inference is the right answer. It supports genuine scale-to-zero between batches and queues requests via S3, so you don't pay for idle GPU. `hf-cloud-sagemaker-production-defaults` has a dedicated `deploy_async.py` for this.
+
+Real-time, real-time scale-to-zero, and async are the three scripted pathways (`deploy.py`, `deploy_ic.py`, `deploy_async.py` in `hf-cloud-sagemaker-production-defaults`). Serverless, batch transform, and Bedrock Custom Model Import are not currently scripted — for those, hand the user off with a brief explanation rather than trying to deploy them through this workflow.
+
+**Scale to zero, real-time or async?** Both reach zero and both make the first request after idle slow. Pick async when one inference can exceed the 60s `InvokeEndpoint` limit, when payloads are large, or when the client can accept an S3 result instead of a synchronous response. Pick real-time scale-to-zero when the client needs a normal synchronous HTTP response and can retry through the wake. Real-time scale-to-zero needs inference components; the plain real-time pathway cannot go below one instance.
+
+If two pathways are both reasonable, say so in one sentence each and pick one. Don't bury the recommendation in options.
+
+## Instance selection: check quota before recommending
+
+Endpoint quotas are per instance type, per region, and default to **0** for GPU types in many accounts. Recommending an instance the account can't launch wastes a full deploy cycle on `ResourceLimitExceeded`. Check first:
+
+```bash
+aws service-quotas list-service-quotas --service-code sagemaker --region <region> \
+    --query "Quotas[?contains(QuotaName, 'for endpoint usage') && Value > \`0\`].[QuotaName, Value]" \
+    --output table
+```
+
+If the type you want isn't in the result, recommend one that is — or tell the user to request an increase (hours to days) *before* creating anything.
+
+If the call itself is denied, say so once and continue. The quota check is an optimization, not a gate: the deployment surfaces the real limit as `ResourceLimitExceeded`. Never stop the workflow, and never ask the user to change IAM, for a preflight check.
+
+GPU family notes for the common 24 GB tier:
+
+- `ml.g5.*` (A10G) and `ml.g6.*` (L4) both work with current vLLM images when the gpu-3-1 AMI is set (see `hf-cloud-serving-image-selection`). g6 is the newer generation and slightly cheaper per hour; g5 has roughly double the memory bandwidth, which usually means better LLM token throughput. Pick whichever has quota; when both do, either is defensible — g5 for throughput, g6 for cost.
+- `ml.g6e.*` (L40S, 48 GB) when the model doesn't fit in 24 GB.
+
+Once you have enough to recommend, state it plainly:
+
+> Based on what you've told me, I'd recommend a real-time endpoint on `ml.g5.xlarge`. The model is small enough that this is cost-effective, and your traffic pattern is steady enough that you won't be paying for idle. Alternative: serverless would be cheaper if traffic dries up for hours at a time, but Qwen3-0.6B is at the edge of serverless memory limits and cold starts would be 15–30s. Want me to proceed with the real-time endpoint?
+
+Then wait for confirmation. The user should know what they're about to spend money on before you create anything.
+
+The plan lives in the conversation — don't generate `plan.yaml` or similar artifacts unless explicitly asked.
+
+## Style
+
+- Users invoking this skill are deferring to the agent because they don't want to do AWS plumbing. Match that energy: efficient, not exhaustive.
+- One round of clarifying questions is usually enough. Three rounds is interrogation.
+- When you don't know something specific (current image URI, SDK API surface, quotas), check it rather than guess. Other skills handle the "how to check" details.
+- If the user pushes back on a recommendation, accept it. They know their constraints better than you do.

package/.agents/skills/hf-cloud-sagemaker-iam-preflight/SKILL.md

@@ -0,0 +1,102 @@
+---
+name: hf-cloud-sagemaker-iam-preflight
+description: 'Ensure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.'
+---
+
+# SageMaker IAM Preflight
+
+Every SageMaker resource needs an **execution role** — the IAM role SageMaker assumes to read model artifacts from S3, pull serving containers from ECR, and write logs. Most deployments fail here because the script tried to create a new role without checking if a usable one already existed, then blew up because the caller is an SSO principal.
+
+This skill encodes the right order: discover, validate, only create if necessary.
+
+## Running the helpers (cross-platform)
+
+The helpers are Python so they run identically on Windows, macOS, and Linux:
+
+```bash
+python3 scripts/check_role.py        # macOS / Linux
+python  scripts/check_role.py        # Windows (PowerShell / cmd)
+```
+
+**Run them from the shell where the AWS CLI already works** — i.e. wherever `aws sts get-caller-identity` succeeds. The script shells out to that same `aws` binary and inherits the shell's profile, region, SSO session, proxy, and credential chain.
+
+> **Windows / WSL / Git Bash caveat.** Do **not** invoke these through a Bash shim (WSL, Git Bash, MSYS) on Windows. Those Bash environments frequently do **not** share the Windows AWS config, credentials, SSO sessions, environment variables, or proxy settings — so `aws sts get-caller-identity` fails inside Bash even when it works natively in PowerShell. (This is exactly why the old `.sh` helpers failed on Windows and were replaced with Python.) If you're in PowerShell, run `python ...\check_role.py` directly in PowerShell. If the helper still can't see your identity, run the same discovery natively (see "Native AWS CLI equivalent" below) in the shell where `aws sts get-caller-identity` returns your ARN.
+
+## Order of operations
+
+### Step 1 — Did the user provide a role?
+
+Validate that one specifically:
+
+```bash
+python3 scripts/check_role.py "<role-name-or-arn>"
+```
+
+On success it prints the ARN to stdout (exit 0). On failure it logs why on stderr. Don't try to silently fix a broken role — surface the problem.
+
+### Step 2 — Discover existing roles
+
+```bash
+python3 scripts/check_role.py
+```
+
+Lists roles matching common SageMaker patterns (`AmazonSageMaker-ExecutionRole-*`, `SageMakerExecutionRole*`, etc.), **ranks by last-used date** (most recent first), validates trust policy in that order, returns the first usable ARN. Most accounts that have used SageMaker before already have one.
+
+Why rank by last-used: in accounts with multiple roles (auto-generated 2021 role + manual project role + etc.), the alphabetically-first one is rarely the actively-maintained one. The most-recently-used role is more likely to have current policies — including cross-account ECR pull. The script prints the ranking so you can see which got picked.
+
+IAM frequently reports **no** `RoleLastUsed` at all (tracking only covers recent activity). When every candidate ties at "never used", the script falls back to **newest creation date** — a newer role is more likely to have current policies than a 2021 leftover.
+
+### Step 3 — Create, only if discovery found nothing
+
+**If the user can create** (has IAM permissions):
+
+```bash
+python3 scripts/create_role.py "<role-name>" "<model-bucket>"
+```
+
+Second arg scopes S3 access to a specific bucket. Omit if unknown; script warns and the user can update the policy later.
+
+**If the user cannot create** (SSO principal — `hf-cloud-aws-context-discovery` will have flagged this):
+
+Stop and surface this clearly. Don't retry alternative IAM operations hoping one works:
+
+> I can't find an existing SageMaker execution role, and you're authenticated via SSO so you can't create one directly. Please either:
+>   - Ask your AWS admin for a SageMaker execution role ARN, or
+>   - Have them grant your SSO permission set `iam:CreateRole`, `iam:PutRolePolicy`
+
+Specific instructions get unblocked fast; vague "permission denied" messages don't.
+
+## What "validated" means
+
+A role is usable when (1) it exists, (2) its trust policy allows `sagemaker.amazonaws.com` to `sts:AssumeRole`, and (3) its permissions grant only the actions and resources this deployment needs. See `references/trust-policy.json` for the canonical trust policy.
+
+`check_role.py` verifies existence and trust because policy evaluation depends on the deployment's exact S3, ECR, logging, and optional output resources. Before deployment, inspect the selected role's policies and compare them with `references/minimum-permissions.json`; add only missing actions and scope them to the required resources. Do not attach `AmazonSageMakerFullAccess` or defer permission review until an `AccessDenied` failure.
+
+## Minimum permissions
+
+`references/minimum-permissions.json` is the standalone inline policy for endpoint execution:
+- `s3:GetObject` + `s3:ListBucket` on the model artifact bucket
+- ECR pull permissions
+- CloudWatch logs and metrics
+
+`create_role.py` installs this inline policy without attaching a managed FullAccess policy. Replace `REPLACE_WITH_MODEL_BUCKET` in the template with the actual bucket name — `create_role.py` does this automatically when given a bucket as its second argument. Add narrowly scoped permissions separately for optional features such as async output or data capture.
+
+## Native AWS CLI equivalent (fallback)
+
+If the Python helper can't run or can't see your identity (rare — usually a broken PATH or running under a Bash shim that lacks AWS context), do the same preflight by hand in the shell where `aws sts get-caller-identity` works. The logic is just AWS CLI calls; the helper exists only to bundle and rank them.
+
+PowerShell:
+
+```powershell
+# 1. List candidate SageMaker roles
+aws iam list-roles --query "Roles[?contains(RoleName,'SageMaker') || contains(RoleName,'sagemaker')]" --output json
+
+# 2. For each candidate, confirm the trust policy allows sagemaker.amazonaws.com
+aws iam get-role --role-name <role-name> --query "Role.AssumeRolePolicyDocument" --output json
+
+# 3. Prefer the most-recently-used role with SageMaker-execution naming
+#    (LastUsedDate is often None for every role — then prefer newest CreateDate)
+aws iam get-role --role-name <role-name> --query "Role.[RoleLastUsed.LastUsedDate, CreateDate]" --output text
+```
+
+Pick the most-recently-used role whose trust policy contains `sagemaker.amazonaws.com`. Use the resulting ARN exactly as if `check_role.py` had returned it. Bash/macOS/Linux use the same commands.

package/.agents/skills/hf-cloud-sagemaker-iam-preflight/references/minimum-permissions.json

@@ -0,0 +1,47 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "S3ModelArtifactAccess",
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:ListBucket"
+      ],
+      "Resource": [
+        "arn:aws:s3:::REPLACE_WITH_MODEL_BUCKET",
+        "arn:aws:s3:::REPLACE_WITH_MODEL_BUCKET/*"
+      ]
+    },
+    {
+      "Sid": "ECRPullServingImages",
+      "Effect": "Allow",
+      "Action": [
+        "ecr:GetAuthorizationToken",
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:BatchGetImage"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudWatchLogs",
+      "Effect": "Allow",
+      "Action": [
+        "logs:CreateLogStream",
+        "logs:CreateLogGroup",
+        "logs:PutLogEvents",
+        "logs:DescribeLogStreams"
+      ],
+      "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*"
+    },
+    {
+      "Sid": "CloudWatchMetrics",
+      "Effect": "Allow",
+      "Action": [
+        "cloudwatch:PutMetricData"
+      ],
+      "Resource": "*"
+    }
+  ]
+}

package/.agents/skills/hf-cloud-sagemaker-iam-preflight/references/trust-policy.json

@@ -0,0 +1,12 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "sagemaker.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}