tribunal-kit 9.2.1 → 9.2.4

package/skills/hf-cloud-python-env-setup/scripts/setup_env.py

@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""Create an isolated Python environment for SageMaker work. Cross-platform.
+
+Idempotent. Prefers uv, falls back to the stdlib venv module.
+
+Handles the platform difference in venv layout: the interpreter lives at
+`<venv>/bin/python` on macOS/Linux and `<venv>\\Scripts\\python.exe` on Windows.
+The path it prints is the correct one for the host OS.
+
+Usage:
+    python setup_env.py [VENV_DIR=.venv] [PYTHON_VERSION=3.12]
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+# 3.10-3.12 is the safe zone for modern boto3 + awscli. 3.13+ may work but ML
+# libs lag on wheel availability.
+SUPPORTED_MIN = (3, 10)
+SUPPORTED_MAX = (3, 12)
+
+IS_WINDOWS = os.name == "nt"
+
+
+def log(msg: str) -> None:
+    print(f"[setup_env] {msg}", file=sys.stderr, flush=True)
+
+
+def parse_version(v: str) -> tuple[int, int]:
+    try:
+        major, minor = (int(p) for p in v.split(".")[:2])
+        return (major, minor)
+    except ValueError:
+        log(f"ERROR: invalid Python version '{v}' (expected e.g. 3.12)")
+        sys.exit(1)
+
+
+def venv_python(venv_dir: Path) -> Path:
+    """Path to the interpreter inside a venv, per platform."""
+    if IS_WINDOWS:
+        return venv_dir / "Scripts" / "python.exe"
+    return venv_dir / "bin" / "python"
+
+
+def interpreter_version(python_path: Path) -> str | None:
+    if not python_path.exists():
+        return None
+    proc = subprocess.run(
+        [str(python_path), "-c",
+         "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')"],
+        capture_output=True, text=True,
+    )
+    return proc.stdout.strip() if proc.returncode == 0 else None
+
+
+def find_base_python(version: str) -> str | None:
+    """Locate a base interpreter for the requested version for `python -m venv`."""
+    # Try `pythonX.Y` (Unix) / `pythonX.Y.exe`, then the Windows `py` launcher.
+    candidate = shutil.which(f"python{version}")
+    if candidate:
+        return candidate
+    if IS_WINDOWS and shutil.which("py"):
+        probe = subprocess.run(["py", f"-{version}", "--version"], capture_output=True, text=True)
+        if probe.returncode == 0:
+            return f"py -{version}"  # sentinel; expanded by caller
+    return None
+
+
+def main() -> int:
+    venv_dir = Path(sys.argv[1]) if len(sys.argv) > 1 else Path(".venv")
+    python_version = sys.argv[2] if len(sys.argv) > 2 else "3.12"
+
+    ver = parse_version(python_version)
+    if not (SUPPORTED_MIN <= ver <= SUPPORTED_MAX):
+        lo = ".".join(map(str, SUPPORTED_MIN))
+        hi = ".".join(map(str, SUPPORTED_MAX))
+        log(f"ERROR: Python {python_version} outside supported range {lo}-{hi}")
+        log("Use 3.10, 3.11, or 3.12.")
+        return 1
+
+    installer = "uv" if shutil.which("uv") else "venv"
+    if installer == "venv":
+        log("uv not found — falling back to python + venv. Consider: https://docs.astral.sh/uv/")
+
+    py = venv_python(venv_dir)
+
+    # Reuse existing env only if Python version matches.
+    current = interpreter_version(py)
+    if current == python_version:
+        log(f"Env exists at {venv_dir} with Python {current} — reusing")
+    else:
+        if current is not None:
+            log(f"Env at {venv_dir} uses Python {current} (wanted {python_version}) — recreating")
+            shutil.rmtree(venv_dir)
+
+        if installer == "uv":
+            uv = shutil.which("uv")
+            if subprocess.run([uv, "venv", "--python", python_version, str(venv_dir)]).returncode != 0:
+                log("ERROR: `uv venv` failed.")
+                return 1
+        else:
+            base = find_base_python(python_version)
+            if not base:
+                log(f"ERROR: python{python_version} not found on PATH.")
+                log("Install via pyenv/asdf/brew/system package manager, the Windows installer, or install uv.")
+                return 1
+            base_cmd = base.split() if base.startswith("py ") else [base]
+            if subprocess.run([*base_cmd, "-m", "venv", str(venv_dir)]).returncode != 0:
+                log("ERROR: `python -m venv` failed.")
+                return 1
+        log(f"Created env at {venv_dir}")
+
+    requirements = Path(__file__).resolve().parent.parent / "requirements.txt"
+    if not requirements.is_file():
+        log(f"ERROR: requirements.txt not found at {requirements}")
+        return 1
+
+    log(f"Installing from {requirements}")
+    if installer == "uv":
+        uv = shutil.which("uv")
+        rc = subprocess.run(
+            [uv, "pip", "install", "--python", str(py), "--upgrade", "-r", str(requirements)]
+        ).returncode
+    else:
+        subprocess.run([str(py), "-m", "pip", "install", "--upgrade", "pip"])
+        rc = subprocess.run(
+            [str(py), "-m", "pip", "install", "--upgrade", "-r", str(requirements)]
+        ).returncode
+    if rc != 0:
+        log("ERROR: dependency install failed.")
+        return 1
+
+    log(f"Done. Invoke directly: {py} <script>")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/skills/hf-cloud-sagemaker-deployment-planner/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: hf-cloud-sagemaker-deployment-planner
+description: 'Plan and coordinate the deployment of a model to Amazon SageMaker AI. Use this skill whenever the user wants to deploy, host, serve, or expose a model on SageMaker or AWS — including phrases like "deploy a model", "host this LLM on AWS", "serve this embedding model", "deploy a reranker", "deploy a text-to-image / diffusion model", "host this for async inference", "create an endpoint", "serve my fine-tuned model", or any request that involves making a model available for inference on AWS. Use this even when the user is vague (e.g. "I just want to get this running on AWS, you figure it out"). Works for text-generation LLMs, embedding models, rerankers, classifiers, text-to-image / diffusion models — picks the right serving stack and chooses between real-time and async inference. This is the entry-point skill for SageMaker deployment work — it asks clarifying questions, picks a deployment pathway, and coordinates the other deployment skills.'
+---
+
+# SageMaker Deployment Planner
+
+You are helping a user deploy a model to Amazon SageMaker. Most users invoking this skill want the model deployed with reasonable defaults, in as few questions as possible. Ask only what you need, recommend a pathway honestly, and hand off to the specialized skills.
+
+## Workflow phases
+
+1. **Discovery** — what is being deployed and what are the constraints (this skill)
+2. **Pathway selection** — real-time / serverless / async / batch / Bedrock CMI (this skill)
+3. **Context preflight** — `hf-cloud-aws-context-discovery`, then `hf-cloud-python-env-setup`
+4. **IAM preflight** — `hf-cloud-sagemaker-iam-preflight`
+5. **Image selection** — `hf-cloud-serving-image-selection`
+6. **Deployment** — `hf-cloud-sagemaker-production-defaults`
+
+Phases 1–2 are this skill's job. The others activate when their patterns match.
+
+## Discovery: ask only what you need
+
+You will eventually need to know:
+
+- **What model**: HuggingFace ID, S3 path to artifacts, or model name. If the user is vague ("the model I fine-tuned"), ask for the artifact location.
+- **Model type**: text-generation LLM, embedding/reranker, or other (classifier, NER, etc.). This determines the serving stack — usually inferable from the model name (anything ending in `-embed-*`, starting with `BAAI/bge-`, `sentence-transformers/*` etc. is embeddings; chat/instruct models are LLMs). Only ask if it's genuinely ambiguous.
+- **Traffic shape**: roughly how often will this be called?
+- **Latency tolerance**: interactive, near-real-time, or async?
+- **Cost sensitivity**: ask only if the user signals it or the traffic pattern is ambiguous.
+
+Region comes from `hf-cloud-aws-context-discovery` — don't ask unless the user volunteers it.
+
+Do **not** front-load all of these. A common minimal set is just: *what model, and roughly how often will it be called?* The model name usually settles the model-type question. That alone is often enough to narrow the pathway to two candidates. If the user already told you something, don't ask again.
+
+## Pathway selection
+
+| Pathway | When it fits | When it does not |
+|---|---|---|
+| **Real-time endpoint** | Steady traffic, sub-second to few-second latency, always-on | Very spiky or very sparse traffic (wastes money on idle) |
+| **Real-time, scale to zero** | Sparse or scheduled traffic, dev/test endpoints, and a client that tolerates a ~9 min first request after idle | Any interactive SLA: every request during the wake fails with a 400 |
+| **Serverless inference** | Spiky/intermittent, tolerates cold starts (~10s+), simpler models | LLMs above a few B params (memory/cold-start limits), strict SLAs |
+| **Async inference** | Long inference (>60s), large payloads, queue-friendly | Interactive synchronous calls |
+| **Batch transform** | Offline scoring over a dataset | Anything online or interactive |
+| **Bedrock Custom Model Import** | Wants Bedrock-compatible API, supported base family, weights only | Custom inference logic, unsupported architectures |
+
+For LLMs, **real-time endpoints are the default** unless traffic is explicitly spiky/sparse or inference is long-running. Serverless looks attractive for "low traffic" cases but most LLMs exceed its memory limits.
+
+For **embeddings**, real-time is again the default — but CPU instances are usually the right choice (much cheaper, fast enough for most embedding workloads). Don't reflexively recommend GPU instances for embedding models; ask `hf-cloud-serving-image-selection` to consider CPU variants if the model is small (<1B params) and traffic is moderate.
+
+For **text-to-image, video generation, or other long-inference workloads** (>30s per request) where traffic is also bursty: async inference is the right answer. It supports genuine scale-to-zero between batches and queues requests via S3, so you don't pay for idle GPU. `hf-cloud-sagemaker-production-defaults` has a dedicated `deploy_async.py` for this.
+
+Real-time, real-time scale-to-zero, and async are the three scripted pathways (`deploy.py`, `deploy_ic.py`, `deploy_async.py` in `hf-cloud-sagemaker-production-defaults`). Serverless, batch transform, and Bedrock Custom Model Import are not currently scripted — for those, hand the user off with a brief explanation rather than trying to deploy them through this workflow.
+
+**Scale to zero, real-time or async?** Both reach zero and both make the first request after idle slow. Pick async when one inference can exceed the 60s `InvokeEndpoint` limit, when payloads are large, or when the client can accept an S3 result instead of a synchronous response. Pick real-time scale-to-zero when the client needs a normal synchronous HTTP response and can retry through the wake. Real-time scale-to-zero needs inference components; the plain real-time pathway cannot go below one instance.
+
+If two pathways are both reasonable, say so in one sentence each and pick one. Don't bury the recommendation in options.
+
+## Instance selection: check quota before recommending
+
+Endpoint quotas are per instance type, per region, and default to **0** for GPU types in many accounts. Recommending an instance the account can't launch wastes a full deploy cycle on `ResourceLimitExceeded`. Check first:
+
+```bash
+aws service-quotas list-service-quotas --service-code sagemaker --region <region> \
+    --query "Quotas[?contains(QuotaName, 'for endpoint usage') && Value > \`0\`].[QuotaName, Value]" \
+    --output table
+```
+
+If the type you want isn't in the result, recommend one that is — or tell the user to request an increase (hours to days) *before* creating anything.
+
+If the call itself is denied, say so once and continue. The quota check is an optimization, not a gate: the deployment surfaces the real limit as `ResourceLimitExceeded`. Never stop the workflow, and never ask the user to change IAM, for a preflight check.
+
+GPU family notes for the common 24 GB tier:
+
+- `ml.g5.*` (A10G) and `ml.g6.*` (L4) both work with current vLLM images when the gpu-3-1 AMI is set (see `hf-cloud-serving-image-selection`). g6 is the newer generation and slightly cheaper per hour; g5 has roughly double the memory bandwidth, which usually means better LLM token throughput. Pick whichever has quota; when both do, either is defensible — g5 for throughput, g6 for cost.
+- `ml.g6e.*` (L40S, 48 GB) when the model doesn't fit in 24 GB.
+
+Once you have enough to recommend, state it plainly:
+
+> Based on what you've told me, I'd recommend a real-time endpoint on `ml.g5.xlarge`. The model is small enough that this is cost-effective, and your traffic pattern is steady enough that you won't be paying for idle. Alternative: serverless would be cheaper if traffic dries up for hours at a time, but Qwen3-0.6B is at the edge of serverless memory limits and cold starts would be 15–30s. Want me to proceed with the real-time endpoint?
+
+Then wait for confirmation. The user should know what they're about to spend money on before you create anything.
+
+The plan lives in the conversation — don't generate `plan.yaml` or similar artifacts unless explicitly asked.
+
+## Style
+
+- Users invoking this skill are deferring to the agent because they don't want to do AWS plumbing. Match that energy: efficient, not exhaustive.
+- One round of clarifying questions is usually enough. Three rounds is interrogation.
+- When you don't know something specific (current image URI, SDK API surface, quotas), check it rather than guess. Other skills handle the "how to check" details.
+- If the user pushes back on a recommendation, accept it. They know their constraints better than you do.

package/skills/hf-cloud-sagemaker-iam-preflight/SKILL.md

@@ -0,0 +1,102 @@
+---
+name: hf-cloud-sagemaker-iam-preflight
+description: 'Ensure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.'
+---
+
+# SageMaker IAM Preflight
+
+Every SageMaker resource needs an **execution role** — the IAM role SageMaker assumes to read model artifacts from S3, pull serving containers from ECR, and write logs. Most deployments fail here because the script tried to create a new role without checking if a usable one already existed, then blew up because the caller is an SSO principal.
+
+This skill encodes the right order: discover, validate, only create if necessary.
+
+## Running the helpers (cross-platform)
+
+The helpers are Python so they run identically on Windows, macOS, and Linux:
+
+```bash
+python3 scripts/check_role.py        # macOS / Linux
+python  scripts/check_role.py        # Windows (PowerShell / cmd)
+```
+
+**Run them from the shell where the AWS CLI already works** — i.e. wherever `aws sts get-caller-identity` succeeds. The script shells out to that same `aws` binary and inherits the shell's profile, region, SSO session, proxy, and credential chain.
+
+> **Windows / WSL / Git Bash caveat.** Do **not** invoke these through a Bash shim (WSL, Git Bash, MSYS) on Windows. Those Bash environments frequently do **not** share the Windows AWS config, credentials, SSO sessions, environment variables, or proxy settings — so `aws sts get-caller-identity` fails inside Bash even when it works natively in PowerShell. (This is exactly why the old `.sh` helpers failed on Windows and were replaced with Python.) If you're in PowerShell, run `python ...\check_role.py` directly in PowerShell. If the helper still can't see your identity, run the same discovery natively (see "Native AWS CLI equivalent" below) in the shell where `aws sts get-caller-identity` returns your ARN.
+
+## Order of operations
+
+### Step 1 — Did the user provide a role?
+
+Validate that one specifically:
+
+```bash
+python3 scripts/check_role.py "<role-name-or-arn>"
+```
+
+On success it prints the ARN to stdout (exit 0). On failure it logs why on stderr. Don't try to silently fix a broken role — surface the problem.
+
+### Step 2 — Discover existing roles
+
+```bash
+python3 scripts/check_role.py
+```
+
+Lists roles matching common SageMaker patterns (`AmazonSageMaker-ExecutionRole-*`, `SageMakerExecutionRole*`, etc.), **ranks by last-used date** (most recent first), validates trust policy in that order, returns the first usable ARN. Most accounts that have used SageMaker before already have one.
+
+Why rank by last-used: in accounts with multiple roles (auto-generated 2021 role + manual project role + etc.), the alphabetically-first one is rarely the actively-maintained one. The most-recently-used role is more likely to have current policies — including cross-account ECR pull. The script prints the ranking so you can see which got picked.
+
+IAM frequently reports **no** `RoleLastUsed` at all (tracking only covers recent activity). When every candidate ties at "never used", the script falls back to **newest creation date** — a newer role is more likely to have current policies than a 2021 leftover.
+
+### Step 3 — Create, only if discovery found nothing
+
+**If the user can create** (has IAM permissions):
+
+```bash
+python3 scripts/create_role.py "<role-name>" "<model-bucket>"
+```
+
+Second arg scopes S3 access to a specific bucket. Omit if unknown; script warns and the user can update the policy later.
+
+**If the user cannot create** (SSO principal — `hf-cloud-aws-context-discovery` will have flagged this):
+
+Stop and surface this clearly. Don't retry alternative IAM operations hoping one works:
+
+> I can't find an existing SageMaker execution role, and you're authenticated via SSO so you can't create one directly. Please either:
+>   - Ask your AWS admin for a SageMaker execution role ARN, or
+>   - Have them grant your SSO permission set `iam:CreateRole`, `iam:PutRolePolicy`
+
+Specific instructions get unblocked fast; vague "permission denied" messages don't.
+
+## What "validated" means
+
+A role is usable when (1) it exists, (2) its trust policy allows `sagemaker.amazonaws.com` to `sts:AssumeRole`, and (3) its permissions grant only the actions and resources this deployment needs. See `references/trust-policy.json` for the canonical trust policy.
+
+`check_role.py` verifies existence and trust because policy evaluation depends on the deployment's exact S3, ECR, logging, and optional output resources. Before deployment, inspect the selected role's policies and compare them with `references/minimum-permissions.json`; add only missing actions and scope them to the required resources. Do not attach `AmazonSageMakerFullAccess` or defer permission review until an `AccessDenied` failure.
+
+## Minimum permissions
+
+`references/minimum-permissions.json` is the standalone inline policy for endpoint execution:
+- `s3:GetObject` + `s3:ListBucket` on the model artifact bucket
+- ECR pull permissions
+- CloudWatch logs and metrics
+
+`create_role.py` installs this inline policy without attaching a managed FullAccess policy. Replace `REPLACE_WITH_MODEL_BUCKET` in the template with the actual bucket name — `create_role.py` does this automatically when given a bucket as its second argument. Add narrowly scoped permissions separately for optional features such as async output or data capture.
+
+## Native AWS CLI equivalent (fallback)
+
+If the Python helper can't run or can't see your identity (rare — usually a broken PATH or running under a Bash shim that lacks AWS context), do the same preflight by hand in the shell where `aws sts get-caller-identity` works. The logic is just AWS CLI calls; the helper exists only to bundle and rank them.
+
+PowerShell:
+
+```powershell
+# 1. List candidate SageMaker roles
+aws iam list-roles --query "Roles[?contains(RoleName,'SageMaker') || contains(RoleName,'sagemaker')]" --output json
+
+# 2. For each candidate, confirm the trust policy allows sagemaker.amazonaws.com
+aws iam get-role --role-name <role-name> --query "Role.AssumeRolePolicyDocument" --output json
+
+# 3. Prefer the most-recently-used role with SageMaker-execution naming
+#    (LastUsedDate is often None for every role — then prefer newest CreateDate)
+aws iam get-role --role-name <role-name> --query "Role.[RoleLastUsed.LastUsedDate, CreateDate]" --output text
+```
+
+Pick the most-recently-used role whose trust policy contains `sagemaker.amazonaws.com`. Use the resulting ARN exactly as if `check_role.py` had returned it. Bash/macOS/Linux use the same commands.

package/skills/hf-cloud-sagemaker-iam-preflight/references/minimum-permissions.json

@@ -0,0 +1,47 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "S3ModelArtifactAccess",
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:ListBucket"
+      ],
+      "Resource": [
+        "arn:aws:s3:::REPLACE_WITH_MODEL_BUCKET",
+        "arn:aws:s3:::REPLACE_WITH_MODEL_BUCKET/*"
+      ]
+    },
+    {
+      "Sid": "ECRPullServingImages",
+      "Effect": "Allow",
+      "Action": [
+        "ecr:GetAuthorizationToken",
+        "ecr:BatchCheckLayerAvailability",
+        "ecr:GetDownloadUrlForLayer",
+        "ecr:BatchGetImage"
+      ],
+      "Resource": "*"
+    },
+    {
+      "Sid": "CloudWatchLogs",
+      "Effect": "Allow",
+      "Action": [
+        "logs:CreateLogStream",
+        "logs:CreateLogGroup",
+        "logs:PutLogEvents",
+        "logs:DescribeLogStreams"
+      ],
+      "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*"
+    },
+    {
+      "Sid": "CloudWatchMetrics",
+      "Effect": "Allow",
+      "Action": [
+        "cloudwatch:PutMetricData"
+      ],
+      "Resource": "*"
+    }
+  ]
+}

package/skills/hf-cloud-sagemaker-iam-preflight/references/trust-policy.json

@@ -0,0 +1,12 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "sagemaker.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+}

package/skills/hf-cloud-sagemaker-iam-preflight/scripts/check_role.py

@@ -0,0 +1,184 @@
+#!/usr/bin/env python3
+"""Discover and validate a SageMaker execution role. Cross-platform (Windows/macOS/Linux).
+
+Without args: searches the account for usable roles, ranks by last-used date
+(newest creation date when last-used is unrecorded), returns the first one
+with a valid trust policy.
+With arg: validates the named role.
+
+Does NOT create roles — see create_role.py.
+
+Why Python (not a shell script): this runs `aws` from the *same* shell the user
+launched it in, inheriting their AWS profile, region, SSO session, proxy, and
+credential chain. A bundled Bash helper on Windows (Git Bash/WSL/MSYS) often
+does NOT share that context, so `aws sts get-caller-identity` fails there even
+when the native CLI works fine. Run this from the shell where `aws sts
+get-caller-identity` already succeeds.
+
+Usage:
+    python check_role.py                          # discover
+    python check_role.py <role-name-or-arn>       # validate a specific role
+
+(On Windows the launcher is usually `python`; on macOS/Linux it's `python3`.)
+
+Exit: 0 = usable role found (ARN printed to stdout)
+      1 = no usable role
+      2 = AWS CLI / credentials error
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import json
+import shutil
+import subprocess
+import sys
+
+ROLE_NAME_PATTERNS = [
+    "AmazonSageMaker-ExecutionRole-*",
+    "SageMakerExecutionRole*",
+    "*SageMaker*Execution*",
+    "*sagemaker*execution*",
+]
+
+
+def log(msg: str) -> None:
+    print(f"[check_role] {msg}", file=sys.stderr, flush=True)
+
+
+def aws_bin() -> str:
+    """Resolve the `aws` executable, honoring PATHEXT (finds aws.exe/aws.cmd on Windows)."""
+    exe = shutil.which("aws")
+    if not exe:
+        log("ERROR: the 'aws' CLI was not found on PATH.")
+        log("Install AWS CLI v2 and confirm `aws sts get-caller-identity` works in this shell.")
+        sys.exit(2)
+    return exe
+
+
+def run_aws(args: list[str]) -> subprocess.CompletedProcess:
+    """Run an aws CLI command, capturing output. Never raises on nonzero exit."""
+    return subprocess.run(
+        [aws_bin(), *args],
+        capture_output=True,
+        text=True,
+    )
+
+
+def get_role(role_name: str) -> dict | None:
+    """Return the Role dict from `aws iam get-role`, or None if it can't be read."""
+    proc = run_aws(["iam", "get-role", "--role-name", role_name, "--output", "json"])
+    if proc.returncode != 0:
+        return None
+    try:
+        return json.loads(proc.stdout)["Role"]
+    except (json.JSONDecodeError, KeyError):
+        return None
+
+
+def trust_allows_sagemaker(role: dict) -> bool:
+    """True if the trust policy lets sagemaker.amazonaws.com assume the role."""
+    trust = role.get("AssumeRolePolicyDocument", {})
+    # Substring check over the serialized doc — matches the original shell helper
+    # and is robust to single/list Principal.Service shapes.
+    return "sagemaker.amazonaws.com" in json.dumps(trust)
+
+
+def validate_role(role_name: str, quiet: bool = False) -> str | None:
+    """Return the role ARN if it exists and trusts SageMaker, else None."""
+    role = get_role(role_name)
+    if role is None:
+        if not quiet:
+            log(f"Role '{role_name}' does not exist or you cannot describe it.")
+        return None
+    if not trust_allows_sagemaker(role):
+        if not quiet:
+            log(f"Role '{role_name}': trust policy does not allow sagemaker.amazonaws.com")
+        return None
+    return role.get("Arn")
+
+
+def main() -> int:
+    if run_aws(["sts", "get-caller-identity"]).returncode != 0:
+        log("ERROR: 'aws sts get-caller-identity' failed. Run hf-cloud-aws-context-discovery first.")
+        log("Run this helper from the shell where the AWS CLI is configured (e.g. PowerShell on Windows).")
+        return 2
+
+    # Path 1: validate a user-supplied role
+    if len(sys.argv) >= 2:
+        supplied = sys.argv[1]
+        role_name = supplied.rsplit("/", 1)[-1] if supplied.startswith("arn:aws:iam::") else supplied
+        log(f"Validating: {role_name}")
+        arn = validate_role(role_name)
+        if arn:
+            log(f"OK: {arn}")
+            print(arn)
+            return 0
+        return 1
+
+    # Path 2: discover candidates
+    log("Searching for SageMaker execution roles in the account...")
+    proc = run_aws(["iam", "list-roles", "--query", "Roles[*].RoleName", "--output", "json"])
+    if proc.returncode != 0:
+        log("Could not list roles (caller likely lacks iam:ListRoles).")
+        log("Ask the user for an existing role ARN, or have someone with IAM access run this.")
+        return 1
+    try:
+        all_roles = json.loads(proc.stdout) or []
+    except json.JSONDecodeError:
+        all_roles = []
+
+    candidates = [
+        name
+        for name in all_roles
+        if any(fnmatch.fnmatchcase(name, pat) for pat in ROLE_NAME_PATTERNS)
+    ]
+
+    if not candidates:
+        log("No matching roles. Options:")
+        log("  1. Ask the user for an ARN (role might have an unusual name)")
+        log("  2. Create one (see create_role.py, requires iam:CreateRole)")
+        return 1
+
+    log(f"Found {len(candidates)} candidate(s): {' '.join(candidates)}")
+
+    # Rank by RoleLastUsed (most recent first) — alphabetical order rarely picks
+    # the actively-maintained role in accounts with multiple SageMaker roles.
+    # Fetch each role once and reuse the result for both ranking and validation.
+    log("Ranking by last-used date (fallback: creation date)...")
+    roles_by_name: dict[str, dict] = {}
+    ranked: list[tuple[str, str, str]] = []  # (last_used, create_date, role_name)
+    for name in candidates:
+        role = get_role(name)
+        if role is None:
+            continue
+        roles_by_name[name] = role
+        last_used = (role.get("RoleLastUsed") or {}).get("LastUsedDate") or ""
+        # IAM often reports no RoleLastUsed at all (tracking only covers recent
+        # activity); when every candidate ties at "", newest CreateDate wins.
+        create_date = str(role.get("CreateDate") or "")
+        # ISO-8601 timestamps sort chronologically as strings; "" (never used)
+        # sorts before any timestamp, so descending order puts it last.
+        ranked.append((last_used, create_date, name))
+
+    ranked.sort(reverse=True)
+
+    log("Ranking (most recent first):")
+    for last_used, create_date, name in ranked:
+        when = f"last used {last_used}" if last_used else f"never used, created {create_date or '?'}"
+        log(f"  - {name} ({when})")
+
+    for _, _, name in ranked:
+        if trust_allows_sagemaker(roles_by_name[name]):
+            arn = roles_by_name[name].get("Arn")
+            log(f"Using: {arn}")
+            print(arn)
+            return 0
+
+    log("No candidate passed validation (they exist but lack correct trust policy).")
+    log("Fix the trust policy or create a new role (see create_role.py).")
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())