fix: resolve private hub Models and aliased references for modelTrainer by tanvikab4 · Pull Request #6201 · aws/sagemaker-python-sdk

tanvikab4 · 2026-08-21T16:55:31Z

Description of changes

Summary

ModelTrainer.from_jumpstart_config(...) could not resolve models that live in a private hub — only public
JumpStart models and (by a fragile assumption) plain private-hub references worked. This change fixes hub-content
resolution so ModelTrainer reaches parity with ModelBuilder, supporting:

Public JumpStart models (unchanged)
Model References in a private hub (pointer to a public model)
Aliased references — filed under a hub content name that differs from the public model_id
Privately-owned Models authored directly into a private hub

Root cause

sagemaker.core.jumpstart.document.get_hub_content_and_document() guessed the hub content type from the hub name:

hub_content_type = "Model" if hub_name == SAGEMAKER_PUBLIC_HUB else "ModelReference"

A private hub can hold either a Model or a ModelReference. This guess meant:

Privately-owned Models were looked up as ModelReference → ResourceNotFound → resolution failed.
The lookup used model_id and ignored hub_content_name, so aliased references were never found.

Fix (sagemaker-core/src/sagemaker/core/jumpstart/document.py)

Replace the guess with a probe: for a private hub, try ModelReference first, then fall back to Model; the
public hub uses Model only. This mirrors ModelBuilder's resolution in accessors.py.
Honor hub_content_name (falling back to model_id) so aliased references resolve.
On miss, raise a combined error naming both content types attempted.

No changes were needed elsewhere: defaults.py already attaches HubAccessConfig based on hub_content_type, and
model_trainer.py / JumpStartConfig already support hub_name/hub_content_name — they become correct automatically
once the content type is resolved honestly.

Testing

Unit (sagemaker-core/tests/unit/jumpstart/test_document.py) — 5 new tests, all passing:

public hub resolves as Model (single lookup, no probe)
private-hub reference resolves on the first probe
private-hub Model resolves via the fallback (asserts probe order ["ModelReference", "Model"])
hub_content_name alias is used for lookup
neither type present → raises after attempting both

Integration (sagemaker-train/tests/integ/jumpstart/test_jumpstart_train.py) — 3 new tests, each creates a
temporary private hub, runs a real training job, and tears down (skips gracefully without hub permissions). All
verified passing end-to-end against AWS:

test_jumpstart_train_from_private_hub_reference
test_jumpstart_train_from_aliased_reference
test_jumpstart_train_from_private_owned_model

Narrohag · 2026-08-25T16:05:40Z

+ deadline = time.time() + timeout
+ while time.time() < deadline:
+ try:
+ resp = sm.list_hub_contents(HubName=hub_name, HubContentType=content_type)


can we use describe_hub_content directly?

switched _wait_for_content to use describe_hub_content directly

Narrohag · 2026-08-25T16:06:32Z

+
+def _default_training_dataset(region, model_id):
+ """Resolve the model's default training dataset S3 URI from JS metadata."""
+ from sagemaker.core.jumpstart.accessors import JumpStartModelsAccessor


let's avoid the lazy imports, claude loves to add them for some reason lol

Narrohag · 2026-08-25T16:08:49Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


is there anything to assert or just validating nothing is thrown?

This test's purpose is to verify the aliased-reference resolution path so when hub_content_name differs from the public model_id, from_jumpstart_config resolves the reference by its alias. I added these assertions to strengthen the test:
_jumpstart_config.hub_content_name == ALIASED_REFERENCE_NAME (the alias was threaded through resolution)
training_image is set
the model channel's S3 source carries a HubAccessConfig with a hub_content_arn

Narrohag · 2026-08-25T16:10:22Z

 model_trainer.train()
+
+
+def test_jumpstart_train_from_private_hub_reference(private_hub, sagemaker_session):


can you add a unit test for training a model reference to a gated model? there should have been a similar test in v2 so you can use that same model. There's some ModelAccessConfig/accept_eula stuff that we should verify works

Added a unit test class TestJumpStartTrainDefaultsGatedModelReferenceEula in test_defaults.py using the same gated model as v2 (mocks the resolver seam and verifies the
ModelAccessConfig/accept_eula behavior)

Sorry, meant integ test. My bad

might have missed it but do we have this as an integ test?

I looked into the v2 tests and there exists a gated private hub test on the ModelBuilder/deploy side, but not one for the training path. I'll add a corresponding integ test for ModelTrainer rn

sahilper · 2026-08-25T17:50:49Z

+ HubDescription="SDK integ test JumpStart training private hub",
+ )
+ except ClientError as e:
+ pytest.skip(f"Cannot create private hub (missing permissions?): {e}")


Skipping gracefully without hub permissions is the right intent, but the implementation is wider than that: every setup step here is a bare except ClientError → skip (create_hub, create_hub_content_reference, import_hub_content, describe_hub_content, and both _wait_for_content timeouts).
The assertion itself fails loudly — from_jumpstart_config isn't wrapped. But if import_hub_content for a private-hub Model breaks service-side, test_jumpstart_train_from_private_owned_model skips and CI stays green, so the test for the core case in this fix silently stops running.
Suggest matching only the specific authorization codes you expect in a restricted account and letting everything else fail; _wait_for_content returning False should be a pytest.fail once the hub was creatable.

Added a _skip_if_unauthorized helper that skips only on an authorization allowlist (AccessDeniedException/AccessForbiddenException/UnauthorizedOperation) and re-raises everything else

sahilper · 2026-08-25T17:52:40Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


This explicit training channel bypasses the hub-aware channel construction the fix enables. _create_training_job_args merges with "method parameter taking precedence" (existing_channels[new_input.channel_name] = new_input), so this bare InputData replaces the channel built by JumpStartTrainDefaults.get_training_dataset_input — the only place ModelAccessConfig and HubAccessConfig(hub_content_arn=...) are attached (defaults.py, hub_content_type == "ModelReference" branch).
So the reference and alias tests never assert that a HubAccessConfig was derived from the resolved hub content, and with a non-gated model like catboost-regression-model they'd pass even if that plumbing were wrong.
The existing test_jumpstart_train calls train() with no arguments and relies on SDK-resolved channels — suggest the same here and dropping _default_training_dataset, which also removes the hardcoded jumpstart-cache-prod-{region} bucket.

Dropped explicit channel and _default_training_dataset. Train() now uses SDK-resolved channels like test_jumpstart_train. Also added assertions on the resolved channels so the plumbing is guarded

github-actions · 2026-08-31T16:49:54Z

Claude finished @tanvikab4's task in 1m 23s —— View job

PR Review: private hub Models & aliased references for ModelTrainer

Overall this is a clean, well-tested fix. The root cause is correctly identified (guessing hub_content_type from the hub name) and the probe + hub_content_name alias handling are the right shape. Tests are thorough — unit tests for the probe/alias/fallback paths, mocked defaults tests for the gated EULA path, and real integ tests. Two prior approvals already; the notes below are the only things I'd raise.

(Note: the inline-comment tool wasn't available to me this run, so findings are inline below with file/line refs.)

1. Fallback only triggers on `ResourceNotFound` — narrower than the ModelBuilder path it claims to mirror

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The PR comment says this "mirrors ModelBuilder's resolution in accessors.py", but accessors.py:303 catches a broad Exception on the first (ModelReference) probe and falls back to Model on any failure. Here, the fallback to Model only happens if the ModelReference lookup returns exactly ResourceNotFound.

The core case this fix enables — a privately-owned Model — relies on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a hub that holds a Model under that name returns something other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model, so private-owned Models would fail to resolve.

The narrower catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception in accessors.py arguably shouldn't), so I'm not asking you to widen it blindly. But worth confirming the exact error code the service returns for a wrong-HubContentType describe, and either (a) verifying it's ResourceNotFound, or (b) adding ValidationException to the fallback set. The test_private_hub_falls_back_to_model unit test hard-codes ResourceNotFound (_not_found()), so it wouldn't catch this — the only thing exercising it is the scheduled/gated integ test.

2. Minor: unnecessary `getattr` defensiveness

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on the (frozen, extra="forbid") JumpStartConfig, so it always exists. The getattr(jumpstart_config, "hub_content_name", None) can be simplified to:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` when `last_error` could be falsy

sagemaker-core/src/sagemaker/core/jumpstart/document.py:91-98

In practice content_types_to_try is never empty and last_error is always set before hub_content is None becomes reachable, so this is safe today. Just flagging that it's an implicit invariant — raise None would produce a confusing TypeError if the list ever became empty. Not worth changing unless you want a belt-and-suspenders raise last_error or RuntimeError(...).

Nothing here blocks merge. Point #1 is the only one I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it.

github-actions · 2026-08-31T23:31:14Z

Claude finished @tanvikab4's task in 1m 18s —— View job

PR Review: private-hub Models & aliased references for ModelTrainer

Read the PR diff
Review document.py change (correctness)
Check accessors.py for the pattern it claims to mirror
Review new unit & integ tests
Post review

The fix is well-targeted and the root-cause analysis is correct: guessing hub_content_type from the hub name is wrong because a private hub can hold either a ModelReference or an owned Model. Probing + honoring hub_content_name is the right shape, and the test coverage (unit probe/alias/fallback, mocked gated-EULA defaults, and real integ tests) is thorough. Already has two approvals; nothing below blocks merge.

(The inline-comment tool wasn't available this run, so findings are listed with file/line refs.)

1. Fallback catch is narrower than the `accessors.py` path it claims to mirror — could break the private-owned-Model case

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The comment says this "mirrors ModelBuilder's resolution in accessors.py," but accessors.py:303 catches a broad Exception on the ModelReference probe and falls back to Model on any failure. Here, the fallback to Model only runs when the ModelReference lookup returns exactly ResourceNotFound.

The core case this PR enables — a privately-owned Model — depends on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a name that exists only as a Model returns anything other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model. test_private_hub_falls_back_to_model hard-codes _not_found() (ResourceNotFound), so it wouldn't catch that — only the gated/scheduled integ test would, and that doesn't run on PR CI.

The narrow catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception arguably shouldn't). But please either (a) confirm the service actually returns ResourceNotFound for a wrong-HubContentType describe, or (b) add ValidationException to the fallback set — and either way, drop or soften the "mirrors accessors.py" comment since the behavior deliberately differs.

2. Minor: unnecessary `getattr`

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on JumpStartConfig (configs.py:51, a frozen extra="forbid" model), so it always exists. Simplify:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` relies on an implicit invariant

sagemaker-core/src/sagemaker/core/jumpstart/document.py:98

Safe today — content_types_to_try is never empty and last_error is always set before hub_content is None is reached. Just noting raise None would surface as a confusing TypeError if that invariant ever broke; a raise last_error or RuntimeError(...) would be belt-and-suspenders. Not worth changing on its own.

Point #1 is the only thing I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it. Everything else is optional polish.

tanvikab4 · 2026-08-21T16:55:31Z

Description of changes

Summary

ModelTrainer.from_jumpstart_config(...) could not resolve models that live in a private hub — only public
JumpStart models and (by a fragile assumption) plain private-hub references worked. This change fixes hub-content
resolution so ModelTrainer reaches parity with ModelBuilder, supporting:

Public JumpStart models (unchanged)
Model References in a private hub (pointer to a public model)
Aliased references — filed under a hub content name that differs from the public model_id
Privately-owned Models authored directly into a private hub

Root cause

sagemaker.core.jumpstart.document.get_hub_content_and_document() guessed the hub content type from the hub name:

hub_content_type = "Model" if hub_name == SAGEMAKER_PUBLIC_HUB else "ModelReference"

A private hub can hold either a Model or a ModelReference. This guess meant:

Privately-owned Models were looked up as ModelReference → ResourceNotFound → resolution failed.
The lookup used model_id and ignored hub_content_name, so aliased references were never found.

Fix (sagemaker-core/src/sagemaker/core/jumpstart/document.py)

Replace the guess with a probe: for a private hub, try ModelReference first, then fall back to Model; the
public hub uses Model only. This mirrors ModelBuilder's resolution in accessors.py.
Honor hub_content_name (falling back to model_id) so aliased references resolve.
On miss, raise a combined error naming both content types attempted.

No changes were needed elsewhere: defaults.py already attaches HubAccessConfig based on hub_content_type, and
model_trainer.py / JumpStartConfig already support hub_name/hub_content_name — they become correct automatically
once the content type is resolved honestly.

Testing

Unit (sagemaker-core/tests/unit/jumpstart/test_document.py) — 5 new tests, all passing:

public hub resolves as Model (single lookup, no probe)
private-hub reference resolves on the first probe
private-hub Model resolves via the fallback (asserts probe order ["ModelReference", "Model"])
hub_content_name alias is used for lookup
neither type present → raises after attempting both

Integration (sagemaker-train/tests/integ/jumpstart/test_jumpstart_train.py) — 3 new tests, each creates a
temporary private hub, runs a real training job, and tears down (skips gracefully without hub permissions). All
verified passing end-to-end against AWS:

test_jumpstart_train_from_private_hub_reference
test_jumpstart_train_from_aliased_reference
test_jumpstart_train_from_private_owned_model

Narrohag · 2026-08-25T16:05:40Z

+ deadline = time.time() + timeout
+ while time.time() < deadline:
+ try:
+ resp = sm.list_hub_contents(HubName=hub_name, HubContentType=content_type)


can we use describe_hub_content directly?

switched _wait_for_content to use describe_hub_content directly

Narrohag · 2026-08-25T16:06:32Z

+
+def _default_training_dataset(region, model_id):
+ """Resolve the model's default training dataset S3 URI from JS metadata."""
+ from sagemaker.core.jumpstart.accessors import JumpStartModelsAccessor


let's avoid the lazy imports, claude loves to add them for some reason lol

Narrohag · 2026-08-25T16:08:49Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


is there anything to assert or just validating nothing is thrown?

This test's purpose is to verify the aliased-reference resolution path so when hub_content_name differs from the public model_id, from_jumpstart_config resolves the reference by its alias. I added these assertions to strengthen the test:
_jumpstart_config.hub_content_name == ALIASED_REFERENCE_NAME (the alias was threaded through resolution)
training_image is set
the model channel's S3 source carries a HubAccessConfig with a hub_content_arn

Narrohag · 2026-08-25T16:10:22Z

 model_trainer.train()
+
+
+def test_jumpstart_train_from_private_hub_reference(private_hub, sagemaker_session):


can you add a unit test for training a model reference to a gated model? there should have been a similar test in v2 so you can use that same model. There's some ModelAccessConfig/accept_eula stuff that we should verify works

Added a unit test class TestJumpStartTrainDefaultsGatedModelReferenceEula in test_defaults.py using the same gated model as v2 (mocks the resolver seam and verifies the
ModelAccessConfig/accept_eula behavior)

Sorry, meant integ test. My bad

might have missed it but do we have this as an integ test?

I looked into the v2 tests and there exists a gated private hub test on the ModelBuilder/deploy side, but not one for the training path. I'll add a corresponding integ test for ModelTrainer rn

sahilper · 2026-08-25T17:50:49Z

+ HubDescription="SDK integ test JumpStart training private hub",
+ )
+ except ClientError as e:
+ pytest.skip(f"Cannot create private hub (missing permissions?): {e}")


Skipping gracefully without hub permissions is the right intent, but the implementation is wider than that: every setup step here is a bare except ClientError → skip (create_hub, create_hub_content_reference, import_hub_content, describe_hub_content, and both _wait_for_content timeouts).
The assertion itself fails loudly — from_jumpstart_config isn't wrapped. But if import_hub_content for a private-hub Model breaks service-side, test_jumpstart_train_from_private_owned_model skips and CI stays green, so the test for the core case in this fix silently stops running.
Suggest matching only the specific authorization codes you expect in a restricted account and letting everything else fail; _wait_for_content returning False should be a pytest.fail once the hub was creatable.

Added a _skip_if_unauthorized helper that skips only on an authorization allowlist (AccessDeniedException/AccessForbiddenException/UnauthorizedOperation) and re-raises everything else

sahilper · 2026-08-25T17:52:40Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


This explicit training channel bypasses the hub-aware channel construction the fix enables. _create_training_job_args merges with "method parameter taking precedence" (existing_channels[new_input.channel_name] = new_input), so this bare InputData replaces the channel built by JumpStartTrainDefaults.get_training_dataset_input — the only place ModelAccessConfig and HubAccessConfig(hub_content_arn=...) are attached (defaults.py, hub_content_type == "ModelReference" branch).
So the reference and alias tests never assert that a HubAccessConfig was derived from the resolved hub content, and with a non-gated model like catboost-regression-model they'd pass even if that plumbing were wrong.
The existing test_jumpstart_train calls train() with no arguments and relies on SDK-resolved channels — suggest the same here and dropping _default_training_dataset, which also removes the hardcoded jumpstart-cache-prod-{region} bucket.

Dropped explicit channel and _default_training_dataset. Train() now uses SDK-resolved channels like test_jumpstart_train. Also added assertions on the resolved channels so the plumbing is guarded

github-actions · 2026-08-31T16:49:54Z

Claude finished @tanvikab4's task in 1m 23s —— View job

PR Review: private hub Models & aliased references for ModelTrainer

Overall this is a clean, well-tested fix. The root cause is correctly identified (guessing hub_content_type from the hub name) and the probe + hub_content_name alias handling are the right shape. Tests are thorough — unit tests for the probe/alias/fallback paths, mocked defaults tests for the gated EULA path, and real integ tests. Two prior approvals already; the notes below are the only things I'd raise.

(Note: the inline-comment tool wasn't available to me this run, so findings are inline below with file/line refs.)

1. Fallback only triggers on `ResourceNotFound` — narrower than the ModelBuilder path it claims to mirror

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The PR comment says this "mirrors ModelBuilder's resolution in accessors.py", but accessors.py:303 catches a broad Exception on the first (ModelReference) probe and falls back to Model on any failure. Here, the fallback to Model only happens if the ModelReference lookup returns exactly ResourceNotFound.

The core case this fix enables — a privately-owned Model — relies on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a hub that holds a Model under that name returns something other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model, so private-owned Models would fail to resolve.

The narrower catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception in accessors.py arguably shouldn't), so I'm not asking you to widen it blindly. But worth confirming the exact error code the service returns for a wrong-HubContentType describe, and either (a) verifying it's ResourceNotFound, or (b) adding ValidationException to the fallback set. The test_private_hub_falls_back_to_model unit test hard-codes ResourceNotFound (_not_found()), so it wouldn't catch this — the only thing exercising it is the scheduled/gated integ test.

2. Minor: unnecessary `getattr` defensiveness

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on the (frozen, extra="forbid") JumpStartConfig, so it always exists. The getattr(jumpstart_config, "hub_content_name", None) can be simplified to:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` when `last_error` could be falsy

sagemaker-core/src/sagemaker/core/jumpstart/document.py:91-98

In practice content_types_to_try is never empty and last_error is always set before hub_content is None becomes reachable, so this is safe today. Just flagging that it's an implicit invariant — raise None would produce a confusing TypeError if the list ever became empty. Not worth changing unless you want a belt-and-suspenders raise last_error or RuntimeError(...).

Nothing here blocks merge. Point #1 is the only one I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it.

github-actions · 2026-08-31T23:31:14Z

Claude finished @tanvikab4's task in 1m 18s —— View job

PR Review: private-hub Models & aliased references for ModelTrainer

Read the PR diff
Review document.py change (correctness)
Check accessors.py for the pattern it claims to mirror
Review new unit & integ tests
Post review

The fix is well-targeted and the root-cause analysis is correct: guessing hub_content_type from the hub name is wrong because a private hub can hold either a ModelReference or an owned Model. Probing + honoring hub_content_name is the right shape, and the test coverage (unit probe/alias/fallback, mocked gated-EULA defaults, and real integ tests) is thorough. Already has two approvals; nothing below blocks merge.

(The inline-comment tool wasn't available this run, so findings are listed with file/line refs.)

1. Fallback catch is narrower than the `accessors.py` path it claims to mirror — could break the private-owned-Model case

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The comment says this "mirrors ModelBuilder's resolution in accessors.py," but accessors.py:303 catches a broad Exception on the ModelReference probe and falls back to Model on any failure. Here, the fallback to Model only runs when the ModelReference lookup returns exactly ResourceNotFound.

The core case this PR enables — a privately-owned Model — depends on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a name that exists only as a Model returns anything other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model. test_private_hub_falls_back_to_model hard-codes _not_found() (ResourceNotFound), so it wouldn't catch that — only the gated/scheduled integ test would, and that doesn't run on PR CI.

The narrow catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception arguably shouldn't). But please either (a) confirm the service actually returns ResourceNotFound for a wrong-HubContentType describe, or (b) add ValidationException to the fallback set — and either way, drop or soften the "mirrors accessors.py" comment since the behavior deliberately differs.

2. Minor: unnecessary `getattr`

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on JumpStartConfig (configs.py:51, a frozen extra="forbid" model), so it always exists. Simplify:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` relies on an implicit invariant

sagemaker-core/src/sagemaker/core/jumpstart/document.py:98

Safe today — content_types_to_try is never empty and last_error is always set before hub_content is None is reached. Just noting raise None would surface as a confusing TypeError if that invariant ever broke; a raise last_error or RuntimeError(...) would be belt-and-suspenders. Not worth changing on its own.

Point #1 is the only thing I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it. Everything else is optional polish.

tanvikab4 · 2026-08-21T16:55:31Z

Description of changes

Summary

ModelTrainer.from_jumpstart_config(...) could not resolve models that live in a private hub — only public
JumpStart models and (by a fragile assumption) plain private-hub references worked. This change fixes hub-content
resolution so ModelTrainer reaches parity with ModelBuilder, supporting:

Public JumpStart models (unchanged)
Model References in a private hub (pointer to a public model)
Aliased references — filed under a hub content name that differs from the public model_id
Privately-owned Models authored directly into a private hub

Root cause

sagemaker.core.jumpstart.document.get_hub_content_and_document() guessed the hub content type from the hub name:

hub_content_type = "Model" if hub_name == SAGEMAKER_PUBLIC_HUB else "ModelReference"

A private hub can hold either a Model or a ModelReference. This guess meant:

Privately-owned Models were looked up as ModelReference → ResourceNotFound → resolution failed.
The lookup used model_id and ignored hub_content_name, so aliased references were never found.

Fix (sagemaker-core/src/sagemaker/core/jumpstart/document.py)

Replace the guess with a probe: for a private hub, try ModelReference first, then fall back to Model; the
public hub uses Model only. This mirrors ModelBuilder's resolution in accessors.py.
Honor hub_content_name (falling back to model_id) so aliased references resolve.
On miss, raise a combined error naming both content types attempted.

No changes were needed elsewhere: defaults.py already attaches HubAccessConfig based on hub_content_type, and
model_trainer.py / JumpStartConfig already support hub_name/hub_content_name — they become correct automatically
once the content type is resolved honestly.

Testing

Unit (sagemaker-core/tests/unit/jumpstart/test_document.py) — 5 new tests, all passing:

public hub resolves as Model (single lookup, no probe)
private-hub reference resolves on the first probe
private-hub Model resolves via the fallback (asserts probe order ["ModelReference", "Model"])
hub_content_name alias is used for lookup
neither type present → raises after attempting both

Integration (sagemaker-train/tests/integ/jumpstart/test_jumpstart_train.py) — 3 new tests, each creates a
temporary private hub, runs a real training job, and tears down (skips gracefully without hub permissions). All
verified passing end-to-end against AWS:

test_jumpstart_train_from_private_hub_reference
test_jumpstart_train_from_aliased_reference
test_jumpstart_train_from_private_owned_model

Narrohag · 2026-08-25T16:05:40Z

+ deadline = time.time() + timeout
+ while time.time() < deadline:
+ try:
+ resp = sm.list_hub_contents(HubName=hub_name, HubContentType=content_type)


can we use describe_hub_content directly?

switched _wait_for_content to use describe_hub_content directly

Narrohag · 2026-08-25T16:06:32Z

+
+def _default_training_dataset(region, model_id):
+ """Resolve the model's default training dataset S3 URI from JS metadata."""
+ from sagemaker.core.jumpstart.accessors import JumpStartModelsAccessor


let's avoid the lazy imports, claude loves to add them for some reason lol

Narrohag · 2026-08-25T16:08:49Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


is there anything to assert or just validating nothing is thrown?

This test's purpose is to verify the aliased-reference resolution path so when hub_content_name differs from the public model_id, from_jumpstart_config resolves the reference by its alias. I added these assertions to strengthen the test:
_jumpstart_config.hub_content_name == ALIASED_REFERENCE_NAME (the alias was threaded through resolution)
training_image is set
the model channel's S3 source carries a HubAccessConfig with a hub_content_arn

Narrohag · 2026-08-25T16:10:22Z

 model_trainer.train()
+
+
+def test_jumpstart_train_from_private_hub_reference(private_hub, sagemaker_session):


can you add a unit test for training a model reference to a gated model? there should have been a similar test in v2 so you can use that same model. There's some ModelAccessConfig/accept_eula stuff that we should verify works

Added a unit test class TestJumpStartTrainDefaultsGatedModelReferenceEula in test_defaults.py using the same gated model as v2 (mocks the resolver seam and verifies the
ModelAccessConfig/accept_eula behavior)

Sorry, meant integ test. My bad

might have missed it but do we have this as an integ test?

I looked into the v2 tests and there exists a gated private hub test on the ModelBuilder/deploy side, but not one for the training path. I'll add a corresponding integ test for ModelTrainer rn

sahilper · 2026-08-25T17:50:49Z

+ HubDescription="SDK integ test JumpStart training private hub",
+ )
+ except ClientError as e:
+ pytest.skip(f"Cannot create private hub (missing permissions?): {e}")


Skipping gracefully without hub permissions is the right intent, but the implementation is wider than that: every setup step here is a bare except ClientError → skip (create_hub, create_hub_content_reference, import_hub_content, describe_hub_content, and both _wait_for_content timeouts).
The assertion itself fails loudly — from_jumpstart_config isn't wrapped. But if import_hub_content for a private-hub Model breaks service-side, test_jumpstart_train_from_private_owned_model skips and CI stays green, so the test for the core case in this fix silently stops running.
Suggest matching only the specific authorization codes you expect in a restricted account and letting everything else fail; _wait_for_content returning False should be a pytest.fail once the hub was creatable.

Added a _skip_if_unauthorized helper that skips only on an authorization allowlist (AccessDeniedException/AccessForbiddenException/UnauthorizedOperation) and re-raises everything else

sahilper · 2026-08-25T17:52:40Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


This explicit training channel bypasses the hub-aware channel construction the fix enables. _create_training_job_args merges with "method parameter taking precedence" (existing_channels[new_input.channel_name] = new_input), so this bare InputData replaces the channel built by JumpStartTrainDefaults.get_training_dataset_input — the only place ModelAccessConfig and HubAccessConfig(hub_content_arn=...) are attached (defaults.py, hub_content_type == "ModelReference" branch).
So the reference and alias tests never assert that a HubAccessConfig was derived from the resolved hub content, and with a non-gated model like catboost-regression-model they'd pass even if that plumbing were wrong.
The existing test_jumpstart_train calls train() with no arguments and relies on SDK-resolved channels — suggest the same here and dropping _default_training_dataset, which also removes the hardcoded jumpstart-cache-prod-{region} bucket.

Dropped explicit channel and _default_training_dataset. Train() now uses SDK-resolved channels like test_jumpstart_train. Also added assertions on the resolved channels so the plumbing is guarded

github-actions · 2026-08-31T16:49:54Z

Claude finished @tanvikab4's task in 1m 23s —— View job

PR Review: private hub Models & aliased references for ModelTrainer

Overall this is a clean, well-tested fix. The root cause is correctly identified (guessing hub_content_type from the hub name) and the probe + hub_content_name alias handling are the right shape. Tests are thorough — unit tests for the probe/alias/fallback paths, mocked defaults tests for the gated EULA path, and real integ tests. Two prior approvals already; the notes below are the only things I'd raise.

(Note: the inline-comment tool wasn't available to me this run, so findings are inline below with file/line refs.)

1. Fallback only triggers on `ResourceNotFound` — narrower than the ModelBuilder path it claims to mirror

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The PR comment says this "mirrors ModelBuilder's resolution in accessors.py", but accessors.py:303 catches a broad Exception on the first (ModelReference) probe and falls back to Model on any failure. Here, the fallback to Model only happens if the ModelReference lookup returns exactly ResourceNotFound.

The core case this fix enables — a privately-owned Model — relies on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a hub that holds a Model under that name returns something other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model, so private-owned Models would fail to resolve.

The narrower catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception in accessors.py arguably shouldn't), so I'm not asking you to widen it blindly. But worth confirming the exact error code the service returns for a wrong-HubContentType describe, and either (a) verifying it's ResourceNotFound, or (b) adding ValidationException to the fallback set. The test_private_hub_falls_back_to_model unit test hard-codes ResourceNotFound (_not_found()), so it wouldn't catch this — the only thing exercising it is the scheduled/gated integ test.

2. Minor: unnecessary `getattr` defensiveness

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on the (frozen, extra="forbid") JumpStartConfig, so it always exists. The getattr(jumpstart_config, "hub_content_name", None) can be simplified to:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` when `last_error` could be falsy

sagemaker-core/src/sagemaker/core/jumpstart/document.py:91-98

In practice content_types_to_try is never empty and last_error is always set before hub_content is None becomes reachable, so this is safe today. Just flagging that it's an implicit invariant — raise None would produce a confusing TypeError if the list ever became empty. Not worth changing unless you want a belt-and-suspenders raise last_error or RuntimeError(...).

Nothing here blocks merge. Point #1 is the only one I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it.

github-actions · 2026-08-31T23:31:14Z

Claude finished @tanvikab4's task in 1m 18s —— View job

PR Review: private-hub Models & aliased references for ModelTrainer

Read the PR diff
Review document.py change (correctness)
Check accessors.py for the pattern it claims to mirror
Review new unit & integ tests
Post review

The fix is well-targeted and the root-cause analysis is correct: guessing hub_content_type from the hub name is wrong because a private hub can hold either a ModelReference or an owned Model. Probing + honoring hub_content_name is the right shape, and the test coverage (unit probe/alias/fallback, mocked gated-EULA defaults, and real integ tests) is thorough. Already has two approvals; nothing below blocks merge.

(The inline-comment tool wasn't available this run, so findings are listed with file/line refs.)

1. Fallback catch is narrower than the `accessors.py` path it claims to mirror — could break the private-owned-Model case

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The comment says this "mirrors ModelBuilder's resolution in accessors.py," but accessors.py:303 catches a broad Exception on the ModelReference probe and falls back to Model on any failure. Here, the fallback to Model only runs when the ModelReference lookup returns exactly ResourceNotFound.

The core case this PR enables — a privately-owned Model — depends on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a name that exists only as a Model returns anything other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model. test_private_hub_falls_back_to_model hard-codes _not_found() (ResourceNotFound), so it wouldn't catch that — only the gated/scheduled integ test would, and that doesn't run on PR CI.

The narrow catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception arguably shouldn't). But please either (a) confirm the service actually returns ResourceNotFound for a wrong-HubContentType describe, or (b) add ValidationException to the fallback set — and either way, drop or soften the "mirrors accessors.py" comment since the behavior deliberately differs.

2. Minor: unnecessary `getattr`

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on JumpStartConfig (configs.py:51, a frozen extra="forbid" model), so it always exists. Simplify:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` relies on an implicit invariant

sagemaker-core/src/sagemaker/core/jumpstart/document.py:98

Safe today — content_types_to_try is never empty and last_error is always set before hub_content is None is reached. Just noting raise None would surface as a confusing TypeError if that invariant ever broke; a raise last_error or RuntimeError(...) would be belt-and-suspenders. Not worth changing on its own.

Point #1 is the only thing I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it. Everything else is optional polish.

tanvikab4 · 2026-08-21T16:55:31Z

Description of changes

Summary

ModelTrainer.from_jumpstart_config(...) could not resolve models that live in a private hub — only public
JumpStart models and (by a fragile assumption) plain private-hub references worked. This change fixes hub-content
resolution so ModelTrainer reaches parity with ModelBuilder, supporting:

Public JumpStart models (unchanged)
Model References in a private hub (pointer to a public model)
Aliased references — filed under a hub content name that differs from the public model_id
Privately-owned Models authored directly into a private hub

Root cause

sagemaker.core.jumpstart.document.get_hub_content_and_document() guessed the hub content type from the hub name:

hub_content_type = "Model" if hub_name == SAGEMAKER_PUBLIC_HUB else "ModelReference"

A private hub can hold either a Model or a ModelReference. This guess meant:

Privately-owned Models were looked up as ModelReference → ResourceNotFound → resolution failed.
The lookup used model_id and ignored hub_content_name, so aliased references were never found.

Fix (sagemaker-core/src/sagemaker/core/jumpstart/document.py)

Replace the guess with a probe: for a private hub, try ModelReference first, then fall back to Model; the
public hub uses Model only. This mirrors ModelBuilder's resolution in accessors.py.
Honor hub_content_name (falling back to model_id) so aliased references resolve.
On miss, raise a combined error naming both content types attempted.

No changes were needed elsewhere: defaults.py already attaches HubAccessConfig based on hub_content_type, and
model_trainer.py / JumpStartConfig already support hub_name/hub_content_name — they become correct automatically
once the content type is resolved honestly.

Testing

Unit (sagemaker-core/tests/unit/jumpstart/test_document.py) — 5 new tests, all passing:

public hub resolves as Model (single lookup, no probe)
private-hub reference resolves on the first probe
private-hub Model resolves via the fallback (asserts probe order ["ModelReference", "Model"])
hub_content_name alias is used for lookup
neither type present → raises after attempting both

Integration (sagemaker-train/tests/integ/jumpstart/test_jumpstart_train.py) — 3 new tests, each creates a
temporary private hub, runs a real training job, and tears down (skips gracefully without hub permissions). All
verified passing end-to-end against AWS:

test_jumpstart_train_from_private_hub_reference
test_jumpstart_train_from_aliased_reference
test_jumpstart_train_from_private_owned_model

Narrohag · 2026-08-25T16:05:40Z

+ deadline = time.time() + timeout
+ while time.time() < deadline:
+ try:
+ resp = sm.list_hub_contents(HubName=hub_name, HubContentType=content_type)


can we use describe_hub_content directly?

switched _wait_for_content to use describe_hub_content directly

Narrohag · 2026-08-25T16:06:32Z

+
+def _default_training_dataset(region, model_id):
+ """Resolve the model's default training dataset S3 URI from JS metadata."""
+ from sagemaker.core.jumpstart.accessors import JumpStartModelsAccessor


let's avoid the lazy imports, claude loves to add them for some reason lol

Narrohag · 2026-08-25T16:08:49Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


is there anything to assert or just validating nothing is thrown?

This test's purpose is to verify the aliased-reference resolution path so when hub_content_name differs from the public model_id, from_jumpstart_config resolves the reference by its alias. I added these assertions to strengthen the test:
_jumpstart_config.hub_content_name == ALIASED_REFERENCE_NAME (the alias was threaded through resolution)
training_image is set
the model channel's S3 source carries a HubAccessConfig with a hub_content_arn

Narrohag · 2026-08-25T16:10:22Z

 model_trainer.train()
+
+
+def test_jumpstart_train_from_private_hub_reference(private_hub, sagemaker_session):


can you add a unit test for training a model reference to a gated model? there should have been a similar test in v2 so you can use that same model. There's some ModelAccessConfig/accept_eula stuff that we should verify works

Added a unit test class TestJumpStartTrainDefaultsGatedModelReferenceEula in test_defaults.py using the same gated model as v2 (mocks the resolver seam and verifies the
ModelAccessConfig/accept_eula behavior)

Sorry, meant integ test. My bad

might have missed it but do we have this as an integ test?

I looked into the v2 tests and there exists a gated private hub test on the ModelBuilder/deploy side, but not one for the training path. I'll add a corresponding integ test for ModelTrainer rn

sahilper · 2026-08-25T17:50:49Z

+ HubDescription="SDK integ test JumpStart training private hub",
+ )
+ except ClientError as e:
+ pytest.skip(f"Cannot create private hub (missing permissions?): {e}")


Skipping gracefully without hub permissions is the right intent, but the implementation is wider than that: every setup step here is a bare except ClientError → skip (create_hub, create_hub_content_reference, import_hub_content, describe_hub_content, and both _wait_for_content timeouts).
The assertion itself fails loudly — from_jumpstart_config isn't wrapped. But if import_hub_content for a private-hub Model breaks service-side, test_jumpstart_train_from_private_owned_model skips and CI stays green, so the test for the core case in this fix silently stops running.
Suggest matching only the specific authorization codes you expect in a restricted account and letting everything else fail; _wait_for_content returning False should be a pytest.fail once the hub was creatable.

Added a _skip_if_unauthorized helper that skips only on an authorization allowlist (AccessDeniedException/AccessForbiddenException/UnauthorizedOperation) and re-raises everything else

sahilper · 2026-08-25T17:52:40Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


This explicit training channel bypasses the hub-aware channel construction the fix enables. _create_training_job_args merges with "method parameter taking precedence" (existing_channels[new_input.channel_name] = new_input), so this bare InputData replaces the channel built by JumpStartTrainDefaults.get_training_dataset_input — the only place ModelAccessConfig and HubAccessConfig(hub_content_arn=...) are attached (defaults.py, hub_content_type == "ModelReference" branch).
So the reference and alias tests never assert that a HubAccessConfig was derived from the resolved hub content, and with a non-gated model like catboost-regression-model they'd pass even if that plumbing were wrong.
The existing test_jumpstart_train calls train() with no arguments and relies on SDK-resolved channels — suggest the same here and dropping _default_training_dataset, which also removes the hardcoded jumpstart-cache-prod-{region} bucket.

Dropped explicit channel and _default_training_dataset. Train() now uses SDK-resolved channels like test_jumpstart_train. Also added assertions on the resolved channels so the plumbing is guarded

github-actions · 2026-08-31T16:49:54Z

Claude finished @tanvikab4's task in 1m 23s —— View job

PR Review: private hub Models & aliased references for ModelTrainer

Overall this is a clean, well-tested fix. The root cause is correctly identified (guessing hub_content_type from the hub name) and the probe + hub_content_name alias handling are the right shape. Tests are thorough — unit tests for the probe/alias/fallback paths, mocked defaults tests for the gated EULA path, and real integ tests. Two prior approvals already; the notes below are the only things I'd raise.

(Note: the inline-comment tool wasn't available to me this run, so findings are inline below with file/line refs.)

1. Fallback only triggers on `ResourceNotFound` — narrower than the ModelBuilder path it claims to mirror

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The PR comment says this "mirrors ModelBuilder's resolution in accessors.py", but accessors.py:303 catches a broad Exception on the first (ModelReference) probe and falls back to Model on any failure. Here, the fallback to Model only happens if the ModelReference lookup returns exactly ResourceNotFound.

The core case this fix enables — a privately-owned Model — relies on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a hub that holds a Model under that name returns something other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model, so private-owned Models would fail to resolve.

The narrower catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception in accessors.py arguably shouldn't), so I'm not asking you to widen it blindly. But worth confirming the exact error code the service returns for a wrong-HubContentType describe, and either (a) verifying it's ResourceNotFound, or (b) adding ValidationException to the fallback set. The test_private_hub_falls_back_to_model unit test hard-codes ResourceNotFound (_not_found()), so it wouldn't catch this — the only thing exercising it is the scheduled/gated integ test.

2. Minor: unnecessary `getattr` defensiveness

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on the (frozen, extra="forbid") JumpStartConfig, so it always exists. The getattr(jumpstart_config, "hub_content_name", None) can be simplified to:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` when `last_error` could be falsy

sagemaker-core/src/sagemaker/core/jumpstart/document.py:91-98

In practice content_types_to_try is never empty and last_error is always set before hub_content is None becomes reachable, so this is safe today. Just flagging that it's an implicit invariant — raise None would produce a confusing TypeError if the list ever became empty. Not worth changing unless you want a belt-and-suspenders raise last_error or RuntimeError(...).

Nothing here blocks merge. Point #1 is the only one I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it.

github-actions · 2026-08-31T23:31:14Z

Claude finished @tanvikab4's task in 1m 18s —— View job

PR Review: private-hub Models & aliased references for ModelTrainer

Read the PR diff
Review document.py change (correctness)
Check accessors.py for the pattern it claims to mirror
Review new unit & integ tests
Post review

The fix is well-targeted and the root-cause analysis is correct: guessing hub_content_type from the hub name is wrong because a private hub can hold either a ModelReference or an owned Model. Probing + honoring hub_content_name is the right shape, and the test coverage (unit probe/alias/fallback, mocked gated-EULA defaults, and real integ tests) is thorough. Already has two approvals; nothing below blocks merge.

(The inline-comment tool wasn't available this run, so findings are listed with file/line refs.)

1. Fallback catch is narrower than the `accessors.py` path it claims to mirror — could break the private-owned-Model case

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The comment says this "mirrors ModelBuilder's resolution in accessors.py," but accessors.py:303 catches a broad Exception on the ModelReference probe and falls back to Model on any failure. Here, the fallback to Model only runs when the ModelReference lookup returns exactly ResourceNotFound.

The core case this PR enables — a privately-owned Model — depends on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a name that exists only as a Model returns anything other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model. test_private_hub_falls_back_to_model hard-codes _not_found() (ResourceNotFound), so it wouldn't catch that — only the gated/scheduled integ test would, and that doesn't run on PR CI.

The narrow catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception arguably shouldn't). But please either (a) confirm the service actually returns ResourceNotFound for a wrong-HubContentType describe, or (b) add ValidationException to the fallback set — and either way, drop or soften the "mirrors accessors.py" comment since the behavior deliberately differs.

2. Minor: unnecessary `getattr`

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on JumpStartConfig (configs.py:51, a frozen extra="forbid" model), so it always exists. Simplify:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` relies on an implicit invariant

sagemaker-core/src/sagemaker/core/jumpstart/document.py:98

Safe today — content_types_to_try is never empty and last_error is always set before hub_content is None is reached. Just noting raise None would surface as a confusing TypeError if that invariant ever broke; a raise last_error or RuntimeError(...) would be belt-and-suspenders. Not worth changing on its own.

Point #1 is the only thing I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it. Everything else is optional polish.

tanvikab4 · 2026-08-21T16:55:31Z

Description of changes

Summary

ModelTrainer.from_jumpstart_config(...) could not resolve models that live in a private hub — only public
JumpStart models and (by a fragile assumption) plain private-hub references worked. This change fixes hub-content
resolution so ModelTrainer reaches parity with ModelBuilder, supporting:

Public JumpStart models (unchanged)
Model References in a private hub (pointer to a public model)
Aliased references — filed under a hub content name that differs from the public model_id
Privately-owned Models authored directly into a private hub

Root cause

sagemaker.core.jumpstart.document.get_hub_content_and_document() guessed the hub content type from the hub name:

hub_content_type = "Model" if hub_name == SAGEMAKER_PUBLIC_HUB else "ModelReference"

A private hub can hold either a Model or a ModelReference. This guess meant:

Privately-owned Models were looked up as ModelReference → ResourceNotFound → resolution failed.
The lookup used model_id and ignored hub_content_name, so aliased references were never found.

Fix (sagemaker-core/src/sagemaker/core/jumpstart/document.py)

Replace the guess with a probe: for a private hub, try ModelReference first, then fall back to Model; the
public hub uses Model only. This mirrors ModelBuilder's resolution in accessors.py.
Honor hub_content_name (falling back to model_id) so aliased references resolve.
On miss, raise a combined error naming both content types attempted.

No changes were needed elsewhere: defaults.py already attaches HubAccessConfig based on hub_content_type, and
model_trainer.py / JumpStartConfig already support hub_name/hub_content_name — they become correct automatically
once the content type is resolved honestly.

Testing

Unit (sagemaker-core/tests/unit/jumpstart/test_document.py) — 5 new tests, all passing:

public hub resolves as Model (single lookup, no probe)
private-hub reference resolves on the first probe
private-hub Model resolves via the fallback (asserts probe order ["ModelReference", "Model"])
hub_content_name alias is used for lookup
neither type present → raises after attempting both

Integration (sagemaker-train/tests/integ/jumpstart/test_jumpstart_train.py) — 3 new tests, each creates a
temporary private hub, runs a real training job, and tears down (skips gracefully without hub permissions). All
verified passing end-to-end against AWS:

test_jumpstart_train_from_private_hub_reference
test_jumpstart_train_from_aliased_reference
test_jumpstart_train_from_private_owned_model

Narrohag · 2026-08-25T16:05:40Z

+ deadline = time.time() + timeout
+ while time.time() < deadline:
+ try:
+ resp = sm.list_hub_contents(HubName=hub_name, HubContentType=content_type)


can we use describe_hub_content directly?

switched _wait_for_content to use describe_hub_content directly

Narrohag · 2026-08-25T16:06:32Z

+
+def _default_training_dataset(region, model_id):
+ """Resolve the model's default training dataset S3 URI from JS metadata."""
+ from sagemaker.core.jumpstart.accessors import JumpStartModelsAccessor


let's avoid the lazy imports, claude loves to add them for some reason lol

Narrohag · 2026-08-25T16:08:49Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


is there anything to assert or just validating nothing is thrown?

This test's purpose is to verify the aliased-reference resolution path so when hub_content_name differs from the public model_id, from_jumpstart_config resolves the reference by its alias. I added these assertions to strengthen the test:
_jumpstart_config.hub_content_name == ALIASED_REFERENCE_NAME (the alias was threaded through resolution)
training_image is set
the model channel's S3 source carries a HubAccessConfig with a hub_content_arn

Narrohag · 2026-08-25T16:10:22Z

 model_trainer.train()
+
+
+def test_jumpstart_train_from_private_hub_reference(private_hub, sagemaker_session):


can you add a unit test for training a model reference to a gated model? there should have been a similar test in v2 so you can use that same model. There's some ModelAccessConfig/accept_eula stuff that we should verify works

Added a unit test class TestJumpStartTrainDefaultsGatedModelReferenceEula in test_defaults.py using the same gated model as v2 (mocks the resolver seam and verifies the
ModelAccessConfig/accept_eula behavior)

Sorry, meant integ test. My bad

might have missed it but do we have this as an integ test?

I looked into the v2 tests and there exists a gated private hub test on the ModelBuilder/deploy side, but not one for the training path. I'll add a corresponding integ test for ModelTrainer rn

sahilper · 2026-08-25T17:50:49Z

+ HubDescription="SDK integ test JumpStart training private hub",
+ )
+ except ClientError as e:
+ pytest.skip(f"Cannot create private hub (missing permissions?): {e}")


Skipping gracefully without hub permissions is the right intent, but the implementation is wider than that: every setup step here is a bare except ClientError → skip (create_hub, create_hub_content_reference, import_hub_content, describe_hub_content, and both _wait_for_content timeouts).
The assertion itself fails loudly — from_jumpstart_config isn't wrapped. But if import_hub_content for a private-hub Model breaks service-side, test_jumpstart_train_from_private_owned_model skips and CI stays green, so the test for the core case in this fix silently stops running.
Suggest matching only the specific authorization codes you expect in a restricted account and letting everything else fail; _wait_for_content returning False should be a pytest.fail once the hub was creatable.

Added a _skip_if_unauthorized helper that skips only on an authorization allowlist (AccessDeniedException/AccessForbiddenException/UnauthorizedOperation) and re-raises everything else

sahilper · 2026-08-25T17:52:40Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


This explicit training channel bypasses the hub-aware channel construction the fix enables. _create_training_job_args merges with "method parameter taking precedence" (existing_channels[new_input.channel_name] = new_input), so this bare InputData replaces the channel built by JumpStartTrainDefaults.get_training_dataset_input — the only place ModelAccessConfig and HubAccessConfig(hub_content_arn=...) are attached (defaults.py, hub_content_type == "ModelReference" branch).
So the reference and alias tests never assert that a HubAccessConfig was derived from the resolved hub content, and with a non-gated model like catboost-regression-model they'd pass even if that plumbing were wrong.
The existing test_jumpstart_train calls train() with no arguments and relies on SDK-resolved channels — suggest the same here and dropping _default_training_dataset, which also removes the hardcoded jumpstart-cache-prod-{region} bucket.

Dropped explicit channel and _default_training_dataset. Train() now uses SDK-resolved channels like test_jumpstart_train. Also added assertions on the resolved channels so the plumbing is guarded

github-actions · 2026-08-31T16:49:54Z

Claude finished @tanvikab4's task in 1m 23s —— View job

PR Review: private hub Models & aliased references for ModelTrainer

Overall this is a clean, well-tested fix. The root cause is correctly identified (guessing hub_content_type from the hub name) and the probe + hub_content_name alias handling are the right shape. Tests are thorough — unit tests for the probe/alias/fallback paths, mocked defaults tests for the gated EULA path, and real integ tests. Two prior approvals already; the notes below are the only things I'd raise.

(Note: the inline-comment tool wasn't available to me this run, so findings are inline below with file/line refs.)

1. Fallback only triggers on `ResourceNotFound` — narrower than the ModelBuilder path it claims to mirror

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The PR comment says this "mirrors ModelBuilder's resolution in accessors.py", but accessors.py:303 catches a broad Exception on the first (ModelReference) probe and falls back to Model on any failure. Here, the fallback to Model only happens if the ModelReference lookup returns exactly ResourceNotFound.

The core case this fix enables — a privately-owned Model — relies on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a hub that holds a Model under that name returns something other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model, so private-owned Models would fail to resolve.

The narrower catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception in accessors.py arguably shouldn't), so I'm not asking you to widen it blindly. But worth confirming the exact error code the service returns for a wrong-HubContentType describe, and either (a) verifying it's ResourceNotFound, or (b) adding ValidationException to the fallback set. The test_private_hub_falls_back_to_model unit test hard-codes ResourceNotFound (_not_found()), so it wouldn't catch this — the only thing exercising it is the scheduled/gated integ test.

2. Minor: unnecessary `getattr` defensiveness

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on the (frozen, extra="forbid") JumpStartConfig, so it always exists. The getattr(jumpstart_config, "hub_content_name", None) can be simplified to:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` when `last_error` could be falsy

sagemaker-core/src/sagemaker/core/jumpstart/document.py:91-98

In practice content_types_to_try is never empty and last_error is always set before hub_content is None becomes reachable, so this is safe today. Just flagging that it's an implicit invariant — raise None would produce a confusing TypeError if the list ever became empty. Not worth changing unless you want a belt-and-suspenders raise last_error or RuntimeError(...).

Nothing here blocks merge. Point #1 is the only one I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it.

github-actions · 2026-08-31T23:31:14Z

Claude finished @tanvikab4's task in 1m 18s —— View job

PR Review: private-hub Models & aliased references for ModelTrainer

Read the PR diff
Review document.py change (correctness)
Check accessors.py for the pattern it claims to mirror
Review new unit & integ tests
Post review

The fix is well-targeted and the root-cause analysis is correct: guessing hub_content_type from the hub name is wrong because a private hub can hold either a ModelReference or an owned Model. Probing + honoring hub_content_name is the right shape, and the test coverage (unit probe/alias/fallback, mocked gated-EULA defaults, and real integ tests) is thorough. Already has two approvals; nothing below blocks merge.

(The inline-comment tool wasn't available this run, so findings are listed with file/line refs.)

1. Fallback catch is narrower than the `accessors.py` path it claims to mirror — could break the private-owned-Model case

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The comment says this "mirrors ModelBuilder's resolution in accessors.py," but accessors.py:303 catches a broad Exception on the ModelReference probe and falls back to Model on any failure. Here, the fallback to Model only runs when the ModelReference lookup returns exactly ResourceNotFound.

The core case this PR enables — a privately-owned Model — depends on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a name that exists only as a Model returns anything other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model. test_private_hub_falls_back_to_model hard-codes _not_found() (ResourceNotFound), so it wouldn't catch that — only the gated/scheduled integ test would, and that doesn't run on PR CI.

The narrow catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception arguably shouldn't). But please either (a) confirm the service actually returns ResourceNotFound for a wrong-HubContentType describe, or (b) add ValidationException to the fallback set — and either way, drop or soften the "mirrors accessors.py" comment since the behavior deliberately differs.

2. Minor: unnecessary `getattr`

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on JumpStartConfig (configs.py:51, a frozen extra="forbid" model), so it always exists. Simplify:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` relies on an implicit invariant

sagemaker-core/src/sagemaker/core/jumpstart/document.py:98

Safe today — content_types_to_try is never empty and last_error is always set before hub_content is None is reached. Just noting raise None would surface as a confusing TypeError if that invariant ever broke; a raise last_error or RuntimeError(...) would be belt-and-suspenders. Not worth changing on its own.

Point #1 is the only thing I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it. Everything else is optional polish.

tanvikab4 · 2026-08-21T16:55:31Z

Description of changes

Summary

ModelTrainer.from_jumpstart_config(...) could not resolve models that live in a private hub — only public
JumpStart models and (by a fragile assumption) plain private-hub references worked. This change fixes hub-content
resolution so ModelTrainer reaches parity with ModelBuilder, supporting:

Public JumpStart models (unchanged)
Model References in a private hub (pointer to a public model)
Aliased references — filed under a hub content name that differs from the public model_id
Privately-owned Models authored directly into a private hub

Root cause

sagemaker.core.jumpstart.document.get_hub_content_and_document() guessed the hub content type from the hub name:

hub_content_type = "Model" if hub_name == SAGEMAKER_PUBLIC_HUB else "ModelReference"

A private hub can hold either a Model or a ModelReference. This guess meant:

Privately-owned Models were looked up as ModelReference → ResourceNotFound → resolution failed.
The lookup used model_id and ignored hub_content_name, so aliased references were never found.

Fix (sagemaker-core/src/sagemaker/core/jumpstart/document.py)

Replace the guess with a probe: for a private hub, try ModelReference first, then fall back to Model; the
public hub uses Model only. This mirrors ModelBuilder's resolution in accessors.py.
Honor hub_content_name (falling back to model_id) so aliased references resolve.
On miss, raise a combined error naming both content types attempted.

No changes were needed elsewhere: defaults.py already attaches HubAccessConfig based on hub_content_type, and
model_trainer.py / JumpStartConfig already support hub_name/hub_content_name — they become correct automatically
once the content type is resolved honestly.

Testing

Unit (sagemaker-core/tests/unit/jumpstart/test_document.py) — 5 new tests, all passing:

public hub resolves as Model (single lookup, no probe)
private-hub reference resolves on the first probe
private-hub Model resolves via the fallback (asserts probe order ["ModelReference", "Model"])
hub_content_name alias is used for lookup
neither type present → raises after attempting both

Integration (sagemaker-train/tests/integ/jumpstart/test_jumpstart_train.py) — 3 new tests, each creates a
temporary private hub, runs a real training job, and tears down (skips gracefully without hub permissions). All
verified passing end-to-end against AWS:

test_jumpstart_train_from_private_hub_reference
test_jumpstart_train_from_aliased_reference
test_jumpstart_train_from_private_owned_model

Narrohag · 2026-08-25T16:05:40Z

+ deadline = time.time() + timeout
+ while time.time() < deadline:
+ try:
+ resp = sm.list_hub_contents(HubName=hub_name, HubContentType=content_type)


can we use describe_hub_content directly?

switched _wait_for_content to use describe_hub_content directly

Narrohag · 2026-08-25T16:06:32Z

+
+def _default_training_dataset(region, model_id):
+ """Resolve the model's default training dataset S3 URI from JS metadata."""
+ from sagemaker.core.jumpstart.accessors import JumpStartModelsAccessor


let's avoid the lazy imports, claude loves to add them for some reason lol

Narrohag · 2026-08-25T16:08:49Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


is there anything to assert or just validating nothing is thrown?

This test's purpose is to verify the aliased-reference resolution path so when hub_content_name differs from the public model_id, from_jumpstart_config resolves the reference by its alias. I added these assertions to strengthen the test:
_jumpstart_config.hub_content_name == ALIASED_REFERENCE_NAME (the alias was threaded through resolution)
training_image is set
the model channel's S3 source carries a HubAccessConfig with a hub_content_arn

Narrohag · 2026-08-25T16:10:22Z

 model_trainer.train()
+
+
+def test_jumpstart_train_from_private_hub_reference(private_hub, sagemaker_session):


can you add a unit test for training a model reference to a gated model? there should have been a similar test in v2 so you can use that same model. There's some ModelAccessConfig/accept_eula stuff that we should verify works

Added a unit test class TestJumpStartTrainDefaultsGatedModelReferenceEula in test_defaults.py using the same gated model as v2 (mocks the resolver seam and verifies the
ModelAccessConfig/accept_eula behavior)

Sorry, meant integ test. My bad

might have missed it but do we have this as an integ test?

I looked into the v2 tests and there exists a gated private hub test on the ModelBuilder/deploy side, but not one for the training path. I'll add a corresponding integ test for ModelTrainer rn

sahilper · 2026-08-25T17:50:49Z

+ HubDescription="SDK integ test JumpStart training private hub",
+ )
+ except ClientError as e:
+ pytest.skip(f"Cannot create private hub (missing permissions?): {e}")


Skipping gracefully without hub permissions is the right intent, but the implementation is wider than that: every setup step here is a bare except ClientError → skip (create_hub, create_hub_content_reference, import_hub_content, describe_hub_content, and both _wait_for_content timeouts).
The assertion itself fails loudly — from_jumpstart_config isn't wrapped. But if import_hub_content for a private-hub Model breaks service-side, test_jumpstart_train_from_private_owned_model skips and CI stays green, so the test for the core case in this fix silently stops running.
Suggest matching only the specific authorization codes you expect in a restricted account and letting everything else fail; _wait_for_content returning False should be a pytest.fail once the hub was creatable.

Added a _skip_if_unauthorized helper that skips only on an authorization allowlist (AccessDeniedException/AccessForbiddenException/UnauthorizedOperation) and re-raises everything else

sahilper · 2026-08-25T17:52:40Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


This explicit training channel bypasses the hub-aware channel construction the fix enables. _create_training_job_args merges with "method parameter taking precedence" (existing_channels[new_input.channel_name] = new_input), so this bare InputData replaces the channel built by JumpStartTrainDefaults.get_training_dataset_input — the only place ModelAccessConfig and HubAccessConfig(hub_content_arn=...) are attached (defaults.py, hub_content_type == "ModelReference" branch).
So the reference and alias tests never assert that a HubAccessConfig was derived from the resolved hub content, and with a non-gated model like catboost-regression-model they'd pass even if that plumbing were wrong.
The existing test_jumpstart_train calls train() with no arguments and relies on SDK-resolved channels — suggest the same here and dropping _default_training_dataset, which also removes the hardcoded jumpstart-cache-prod-{region} bucket.

Dropped explicit channel and _default_training_dataset. Train() now uses SDK-resolved channels like test_jumpstart_train. Also added assertions on the resolved channels so the plumbing is guarded

github-actions · 2026-08-31T16:49:54Z

Claude finished @tanvikab4's task in 1m 23s —— View job

PR Review: private hub Models & aliased references for ModelTrainer

Overall this is a clean, well-tested fix. The root cause is correctly identified (guessing hub_content_type from the hub name) and the probe + hub_content_name alias handling are the right shape. Tests are thorough — unit tests for the probe/alias/fallback paths, mocked defaults tests for the gated EULA path, and real integ tests. Two prior approvals already; the notes below are the only things I'd raise.

(Note: the inline-comment tool wasn't available to me this run, so findings are inline below with file/line refs.)

1. Fallback only triggers on `ResourceNotFound` — narrower than the ModelBuilder path it claims to mirror

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The PR comment says this "mirrors ModelBuilder's resolution in accessors.py", but accessors.py:303 catches a broad Exception on the first (ModelReference) probe and falls back to Model on any failure. Here, the fallback to Model only happens if the ModelReference lookup returns exactly ResourceNotFound.

The core case this fix enables — a privately-owned Model — relies on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a hub that holds a Model under that name returns something other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model, so private-owned Models would fail to resolve.

The narrower catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception in accessors.py arguably shouldn't), so I'm not asking you to widen it blindly. But worth confirming the exact error code the service returns for a wrong-HubContentType describe, and either (a) verifying it's ResourceNotFound, or (b) adding ValidationException to the fallback set. The test_private_hub_falls_back_to_model unit test hard-codes ResourceNotFound (_not_found()), so it wouldn't catch this — the only thing exercising it is the scheduled/gated integ test.

2. Minor: unnecessary `getattr` defensiveness

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on the (frozen, extra="forbid") JumpStartConfig, so it always exists. The getattr(jumpstart_config, "hub_content_name", None) can be simplified to:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` when `last_error` could be falsy

sagemaker-core/src/sagemaker/core/jumpstart/document.py:91-98

In practice content_types_to_try is never empty and last_error is always set before hub_content is None becomes reachable, so this is safe today. Just flagging that it's an implicit invariant — raise None would produce a confusing TypeError if the list ever became empty. Not worth changing unless you want a belt-and-suspenders raise last_error or RuntimeError(...).

Nothing here blocks merge. Point #1 is the only one I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it.

github-actions · 2026-08-31T23:31:14Z

Claude finished @tanvikab4's task in 1m 18s —— View job

PR Review: private-hub Models & aliased references for ModelTrainer

Read the PR diff
Review document.py change (correctness)
Check accessors.py for the pattern it claims to mirror
Review new unit & integ tests
Post review

The fix is well-targeted and the root-cause analysis is correct: guessing hub_content_type from the hub name is wrong because a private hub can hold either a ModelReference or an owned Model. Probing + honoring hub_content_name is the right shape, and the test coverage (unit probe/alias/fallback, mocked gated-EULA defaults, and real integ tests) is thorough. Already has two approvals; nothing below blocks merge.

(The inline-comment tool wasn't available this run, so findings are listed with file/line refs.)

1. Fallback catch is narrower than the `accessors.py` path it claims to mirror — could break the private-owned-Model case

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The comment says this "mirrors ModelBuilder's resolution in accessors.py," but accessors.py:303 catches a broad Exception on the ModelReference probe and falls back to Model on any failure. Here, the fallback to Model only runs when the ModelReference lookup returns exactly ResourceNotFound.

The core case this PR enables — a privately-owned Model — depends on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a name that exists only as a Model returns anything other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model. test_private_hub_falls_back_to_model hard-codes _not_found() (ResourceNotFound), so it wouldn't catch that — only the gated/scheduled integ test would, and that doesn't run on PR CI.

The narrow catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception arguably shouldn't). But please either (a) confirm the service actually returns ResourceNotFound for a wrong-HubContentType describe, or (b) add ValidationException to the fallback set — and either way, drop or soften the "mirrors accessors.py" comment since the behavior deliberately differs.

2. Minor: unnecessary `getattr`

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on JumpStartConfig (configs.py:51, a frozen extra="forbid" model), so it always exists. Simplify:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` relies on an implicit invariant

sagemaker-core/src/sagemaker/core/jumpstart/document.py:98

Safe today — content_types_to_try is never empty and last_error is always set before hub_content is None is reached. Just noting raise None would surface as a confusing TypeError if that invariant ever broke; a raise last_error or RuntimeError(...) would be belt-and-suspenders. Not worth changing on its own.

Point #1 is the only thing I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it. Everything else is optional polish.

tanvikab4 · 2026-08-21T16:55:31Z

Description of changes

Summary

ModelTrainer.from_jumpstart_config(...) could not resolve models that live in a private hub — only public
JumpStart models and (by a fragile assumption) plain private-hub references worked. This change fixes hub-content
resolution so ModelTrainer reaches parity with ModelBuilder, supporting:

Public JumpStart models (unchanged)
Model References in a private hub (pointer to a public model)
Aliased references — filed under a hub content name that differs from the public model_id
Privately-owned Models authored directly into a private hub

Root cause

sagemaker.core.jumpstart.document.get_hub_content_and_document() guessed the hub content type from the hub name:

hub_content_type = "Model" if hub_name == SAGEMAKER_PUBLIC_HUB else "ModelReference"

A private hub can hold either a Model or a ModelReference. This guess meant:

Privately-owned Models were looked up as ModelReference → ResourceNotFound → resolution failed.
The lookup used model_id and ignored hub_content_name, so aliased references were never found.

Fix (sagemaker-core/src/sagemaker/core/jumpstart/document.py)

Replace the guess with a probe: for a private hub, try ModelReference first, then fall back to Model; the
public hub uses Model only. This mirrors ModelBuilder's resolution in accessors.py.
Honor hub_content_name (falling back to model_id) so aliased references resolve.
On miss, raise a combined error naming both content types attempted.

No changes were needed elsewhere: defaults.py already attaches HubAccessConfig based on hub_content_type, and
model_trainer.py / JumpStartConfig already support hub_name/hub_content_name — they become correct automatically
once the content type is resolved honestly.

Testing

Unit (sagemaker-core/tests/unit/jumpstart/test_document.py) — 5 new tests, all passing:

public hub resolves as Model (single lookup, no probe)
private-hub reference resolves on the first probe
private-hub Model resolves via the fallback (asserts probe order ["ModelReference", "Model"])
hub_content_name alias is used for lookup
neither type present → raises after attempting both

Integration (sagemaker-train/tests/integ/jumpstart/test_jumpstart_train.py) — 3 new tests, each creates a
temporary private hub, runs a real training job, and tears down (skips gracefully without hub permissions). All
verified passing end-to-end against AWS:

test_jumpstart_train_from_private_hub_reference
test_jumpstart_train_from_aliased_reference
test_jumpstart_train_from_private_owned_model

Narrohag · 2026-08-25T16:05:40Z

+ deadline = time.time() + timeout
+ while time.time() < deadline:
+ try:
+ resp = sm.list_hub_contents(HubName=hub_name, HubContentType=content_type)


can we use describe_hub_content directly?

switched _wait_for_content to use describe_hub_content directly

Narrohag · 2026-08-25T16:06:32Z

+
+def _default_training_dataset(region, model_id):
+ """Resolve the model's default training dataset S3 URI from JS metadata."""
+ from sagemaker.core.jumpstart.accessors import JumpStartModelsAccessor


let's avoid the lazy imports, claude loves to add them for some reason lol

Narrohag · 2026-08-25T16:08:49Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


is there anything to assert or just validating nothing is thrown?

This test's purpose is to verify the aliased-reference resolution path so when hub_content_name differs from the public model_id, from_jumpstart_config resolves the reference by its alias. I added these assertions to strengthen the test:
_jumpstart_config.hub_content_name == ALIASED_REFERENCE_NAME (the alias was threaded through resolution)
training_image is set
the model channel's S3 source carries a HubAccessConfig with a hub_content_arn

Narrohag · 2026-08-25T16:10:22Z

 model_trainer.train()
+
+
+def test_jumpstart_train_from_private_hub_reference(private_hub, sagemaker_session):


can you add a unit test for training a model reference to a gated model? there should have been a similar test in v2 so you can use that same model. There's some ModelAccessConfig/accept_eula stuff that we should verify works

Added a unit test class TestJumpStartTrainDefaultsGatedModelReferenceEula in test_defaults.py using the same gated model as v2 (mocks the resolver seam and verifies the
ModelAccessConfig/accept_eula behavior)

Sorry, meant integ test. My bad

might have missed it but do we have this as an integ test?

I looked into the v2 tests and there exists a gated private hub test on the ModelBuilder/deploy side, but not one for the training path. I'll add a corresponding integ test for ModelTrainer rn

sahilper · 2026-08-25T17:50:49Z

+ HubDescription="SDK integ test JumpStart training private hub",
+ )
+ except ClientError as e:
+ pytest.skip(f"Cannot create private hub (missing permissions?): {e}")


Skipping gracefully without hub permissions is the right intent, but the implementation is wider than that: every setup step here is a bare except ClientError → skip (create_hub, create_hub_content_reference, import_hub_content, describe_hub_content, and both _wait_for_content timeouts).
The assertion itself fails loudly — from_jumpstart_config isn't wrapped. But if import_hub_content for a private-hub Model breaks service-side, test_jumpstart_train_from_private_owned_model skips and CI stays green, so the test for the core case in this fix silently stops running.
Suggest matching only the specific authorization codes you expect in a restricted account and letting everything else fail; _wait_for_content returning False should be a pytest.fail once the hub was creatable.

Added a _skip_if_unauthorized helper that skips only on an authorization allowlist (AccessDeniedException/AccessForbiddenException/UnauthorizedOperation) and re-raises everything else

sahilper · 2026-08-25T17:52:40Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


This explicit training channel bypasses the hub-aware channel construction the fix enables. _create_training_job_args merges with "method parameter taking precedence" (existing_channels[new_input.channel_name] = new_input), so this bare InputData replaces the channel built by JumpStartTrainDefaults.get_training_dataset_input — the only place ModelAccessConfig and HubAccessConfig(hub_content_arn=...) are attached (defaults.py, hub_content_type == "ModelReference" branch).
So the reference and alias tests never assert that a HubAccessConfig was derived from the resolved hub content, and with a non-gated model like catboost-regression-model they'd pass even if that plumbing were wrong.
The existing test_jumpstart_train calls train() with no arguments and relies on SDK-resolved channels — suggest the same here and dropping _default_training_dataset, which also removes the hardcoded jumpstart-cache-prod-{region} bucket.

Dropped explicit channel and _default_training_dataset. Train() now uses SDK-resolved channels like test_jumpstart_train. Also added assertions on the resolved channels so the plumbing is guarded

github-actions · 2026-08-31T16:49:54Z

Claude finished @tanvikab4's task in 1m 23s —— View job

PR Review: private hub Models & aliased references for ModelTrainer

Overall this is a clean, well-tested fix. The root cause is correctly identified (guessing hub_content_type from the hub name) and the probe + hub_content_name alias handling are the right shape. Tests are thorough — unit tests for the probe/alias/fallback paths, mocked defaults tests for the gated EULA path, and real integ tests. Two prior approvals already; the notes below are the only things I'd raise.

(Note: the inline-comment tool wasn't available to me this run, so findings are inline below with file/line refs.)

1. Fallback only triggers on `ResourceNotFound` — narrower than the ModelBuilder path it claims to mirror

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The PR comment says this "mirrors ModelBuilder's resolution in accessors.py", but accessors.py:303 catches a broad Exception on the first (ModelReference) probe and falls back to Model on any failure. Here, the fallback to Model only happens if the ModelReference lookup returns exactly ResourceNotFound.

The core case this fix enables — a privately-owned Model — relies on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a hub that holds a Model under that name returns something other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model, so private-owned Models would fail to resolve.

The narrower catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception in accessors.py arguably shouldn't), so I'm not asking you to widen it blindly. But worth confirming the exact error code the service returns for a wrong-HubContentType describe, and either (a) verifying it's ResourceNotFound, or (b) adding ValidationException to the fallback set. The test_private_hub_falls_back_to_model unit test hard-codes ResourceNotFound (_not_found()), so it wouldn't catch this — the only thing exercising it is the scheduled/gated integ test.

2. Minor: unnecessary `getattr` defensiveness

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on the (frozen, extra="forbid") JumpStartConfig, so it always exists. The getattr(jumpstart_config, "hub_content_name", None) can be simplified to:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` when `last_error` could be falsy

sagemaker-core/src/sagemaker/core/jumpstart/document.py:91-98

In practice content_types_to_try is never empty and last_error is always set before hub_content is None becomes reachable, so this is safe today. Just flagging that it's an implicit invariant — raise None would produce a confusing TypeError if the list ever became empty. Not worth changing unless you want a belt-and-suspenders raise last_error or RuntimeError(...).

Nothing here blocks merge. Point #1 is the only one I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it.

github-actions · 2026-08-31T23:31:14Z

Claude finished @tanvikab4's task in 1m 18s —— View job

PR Review: private-hub Models & aliased references for ModelTrainer

Read the PR diff
Review document.py change (correctness)
Check accessors.py for the pattern it claims to mirror
Review new unit & integ tests
Post review

The fix is well-targeted and the root-cause analysis is correct: guessing hub_content_type from the hub name is wrong because a private hub can hold either a ModelReference or an owned Model. Probing + honoring hub_content_name is the right shape, and the test coverage (unit probe/alias/fallback, mocked gated-EULA defaults, and real integ tests) is thorough. Already has two approvals; nothing below blocks merge.

(The inline-comment tool wasn't available this run, so findings are listed with file/line refs.)

1. Fallback catch is narrower than the `accessors.py` path it claims to mirror — could break the private-owned-Model case

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The comment says this "mirrors ModelBuilder's resolution in accessors.py," but accessors.py:303 catches a broad Exception on the ModelReference probe and falls back to Model on any failure. Here, the fallback to Model only runs when the ModelReference lookup returns exactly ResourceNotFound.

The core case this PR enables — a privately-owned Model — depends on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a name that exists only as a Model returns anything other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model. test_private_hub_falls_back_to_model hard-codes _not_found() (ResourceNotFound), so it wouldn't catch that — only the gated/scheduled integ test would, and that doesn't run on PR CI.

The narrow catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception arguably shouldn't). But please either (a) confirm the service actually returns ResourceNotFound for a wrong-HubContentType describe, or (b) add ValidationException to the fallback set — and either way, drop or soften the "mirrors accessors.py" comment since the behavior deliberately differs.

2. Minor: unnecessary `getattr`

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on JumpStartConfig (configs.py:51, a frozen extra="forbid" model), so it always exists. Simplify:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` relies on an implicit invariant

sagemaker-core/src/sagemaker/core/jumpstart/document.py:98

Safe today — content_types_to_try is never empty and last_error is always set before hub_content is None is reached. Just noting raise None would surface as a confusing TypeError if that invariant ever broke; a raise last_error or RuntimeError(...) would be belt-and-suspenders. Not worth changing on its own.

Point #1 is the only thing I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it. Everything else is optional polish.

tanvikab4 · 2026-08-21T16:55:31Z

Description of changes

Summary

ModelTrainer.from_jumpstart_config(...) could not resolve models that live in a private hub — only public
JumpStart models and (by a fragile assumption) plain private-hub references worked. This change fixes hub-content
resolution so ModelTrainer reaches parity with ModelBuilder, supporting:

Public JumpStart models (unchanged)
Model References in a private hub (pointer to a public model)
Aliased references — filed under a hub content name that differs from the public model_id
Privately-owned Models authored directly into a private hub

Root cause

sagemaker.core.jumpstart.document.get_hub_content_and_document() guessed the hub content type from the hub name:

hub_content_type = "Model" if hub_name == SAGEMAKER_PUBLIC_HUB else "ModelReference"

A private hub can hold either a Model or a ModelReference. This guess meant:

Privately-owned Models were looked up as ModelReference → ResourceNotFound → resolution failed.
The lookup used model_id and ignored hub_content_name, so aliased references were never found.

Fix (sagemaker-core/src/sagemaker/core/jumpstart/document.py)

Replace the guess with a probe: for a private hub, try ModelReference first, then fall back to Model; the
public hub uses Model only. This mirrors ModelBuilder's resolution in accessors.py.
Honor hub_content_name (falling back to model_id) so aliased references resolve.
On miss, raise a combined error naming both content types attempted.

No changes were needed elsewhere: defaults.py already attaches HubAccessConfig based on hub_content_type, and
model_trainer.py / JumpStartConfig already support hub_name/hub_content_name — they become correct automatically
once the content type is resolved honestly.

Testing

Unit (sagemaker-core/tests/unit/jumpstart/test_document.py) — 5 new tests, all passing:

public hub resolves as Model (single lookup, no probe)
private-hub reference resolves on the first probe
private-hub Model resolves via the fallback (asserts probe order ["ModelReference", "Model"])
hub_content_name alias is used for lookup
neither type present → raises after attempting both

Integration (sagemaker-train/tests/integ/jumpstart/test_jumpstart_train.py) — 3 new tests, each creates a
temporary private hub, runs a real training job, and tears down (skips gracefully without hub permissions). All
verified passing end-to-end against AWS:

test_jumpstart_train_from_private_hub_reference
test_jumpstart_train_from_aliased_reference
test_jumpstart_train_from_private_owned_model

Narrohag · 2026-08-25T16:05:40Z

+ deadline = time.time() + timeout
+ while time.time() < deadline:
+ try:
+ resp = sm.list_hub_contents(HubName=hub_name, HubContentType=content_type)


can we use describe_hub_content directly?

switched _wait_for_content to use describe_hub_content directly

Narrohag · 2026-08-25T16:06:32Z

+
+def _default_training_dataset(region, model_id):
+ """Resolve the model's default training dataset S3 URI from JS metadata."""
+ from sagemaker.core.jumpstart.accessors import JumpStartModelsAccessor


let's avoid the lazy imports, claude loves to add them for some reason lol

Narrohag · 2026-08-25T16:08:49Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


is there anything to assert or just validating nothing is thrown?

This test's purpose is to verify the aliased-reference resolution path so when hub_content_name differs from the public model_id, from_jumpstart_config resolves the reference by its alias. I added these assertions to strengthen the test:
_jumpstart_config.hub_content_name == ALIASED_REFERENCE_NAME (the alias was threaded through resolution)
training_image is set
the model channel's S3 source carries a HubAccessConfig with a hub_content_arn

Narrohag · 2026-08-25T16:10:22Z

 model_trainer.train()
+
+
+def test_jumpstart_train_from_private_hub_reference(private_hub, sagemaker_session):


can you add a unit test for training a model reference to a gated model? there should have been a similar test in v2 so you can use that same model. There's some ModelAccessConfig/accept_eula stuff that we should verify works

Added a unit test class TestJumpStartTrainDefaultsGatedModelReferenceEula in test_defaults.py using the same gated model as v2 (mocks the resolver seam and verifies the
ModelAccessConfig/accept_eula behavior)

Sorry, meant integ test. My bad

might have missed it but do we have this as an integ test?

I looked into the v2 tests and there exists a gated private hub test on the ModelBuilder/deploy side, but not one for the training path. I'll add a corresponding integ test for ModelTrainer rn

sahilper · 2026-08-25T17:50:49Z

+ HubDescription="SDK integ test JumpStart training private hub",
+ )
+ except ClientError as e:
+ pytest.skip(f"Cannot create private hub (missing permissions?): {e}")


Skipping gracefully without hub permissions is the right intent, but the implementation is wider than that: every setup step here is a bare except ClientError → skip (create_hub, create_hub_content_reference, import_hub_content, describe_hub_content, and both _wait_for_content timeouts).
The assertion itself fails loudly — from_jumpstart_config isn't wrapped. But if import_hub_content for a private-hub Model breaks service-side, test_jumpstart_train_from_private_owned_model skips and CI stays green, so the test for the core case in this fix silently stops running.
Suggest matching only the specific authorization codes you expect in a restricted account and letting everything else fail; _wait_for_content returning False should be a pytest.fail once the hub was creatable.

Added a _skip_if_unauthorized helper that skips only on an authorization allowlist (AccessDeniedException/AccessForbiddenException/UnauthorizedOperation) and re-raises everything else

sahilper · 2026-08-25T17:52:40Z

+ compute=Compute(instance_type="ml.m5.xlarge"),
+ sagemaker_session=sagemaker_session,
+ )
+ model_trainer.train(input_data_config=[InputData(channel_name="training", data_source=dataset)])


This explicit training channel bypasses the hub-aware channel construction the fix enables. _create_training_job_args merges with "method parameter taking precedence" (existing_channels[new_input.channel_name] = new_input), so this bare InputData replaces the channel built by JumpStartTrainDefaults.get_training_dataset_input — the only place ModelAccessConfig and HubAccessConfig(hub_content_arn=...) are attached (defaults.py, hub_content_type == "ModelReference" branch).
So the reference and alias tests never assert that a HubAccessConfig was derived from the resolved hub content, and with a non-gated model like catboost-regression-model they'd pass even if that plumbing were wrong.
The existing test_jumpstart_train calls train() with no arguments and relies on SDK-resolved channels — suggest the same here and dropping _default_training_dataset, which also removes the hardcoded jumpstart-cache-prod-{region} bucket.

Dropped explicit channel and _default_training_dataset. Train() now uses SDK-resolved channels like test_jumpstart_train. Also added assertions on the resolved channels so the plumbing is guarded

github-actions · 2026-08-31T16:49:54Z

Claude finished @tanvikab4's task in 1m 23s —— View job

PR Review: private hub Models & aliased references for ModelTrainer

Overall this is a clean, well-tested fix. The root cause is correctly identified (guessing hub_content_type from the hub name) and the probe + hub_content_name alias handling are the right shape. Tests are thorough — unit tests for the probe/alias/fallback paths, mocked defaults tests for the gated EULA path, and real integ tests. Two prior approvals already; the notes below are the only things I'd raise.

(Note: the inline-comment tool wasn't available to me this run, so findings are inline below with file/line refs.)

1. Fallback only triggers on `ResourceNotFound` — narrower than the ModelBuilder path it claims to mirror

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The PR comment says this "mirrors ModelBuilder's resolution in accessors.py", but accessors.py:303 catches a broad Exception on the first (ModelReference) probe and falls back to Model on any failure. Here, the fallback to Model only happens if the ModelReference lookup returns exactly ResourceNotFound.

The core case this fix enables — a privately-owned Model — relies on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a hub that holds a Model under that name returns something other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model, so private-owned Models would fail to resolve.

The narrower catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception in accessors.py arguably shouldn't), so I'm not asking you to widen it blindly. But worth confirming the exact error code the service returns for a wrong-HubContentType describe, and either (a) verifying it's ResourceNotFound, or (b) adding ValidationException to the fallback set. The test_private_hub_falls_back_to_model unit test hard-codes ResourceNotFound (_not_found()), so it wouldn't catch this — the only thing exercising it is the scheduled/gated integ test.

2. Minor: unnecessary `getattr` defensiveness

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on the (frozen, extra="forbid") JumpStartConfig, so it always exists. The getattr(jumpstart_config, "hub_content_name", None) can be simplified to:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` when `last_error` could be falsy

sagemaker-core/src/sagemaker/core/jumpstart/document.py:91-98

In practice content_types_to_try is never empty and last_error is always set before hub_content is None becomes reachable, so this is safe today. Just flagging that it's an implicit invariant — raise None would produce a confusing TypeError if the list ever became empty. Not worth changing unless you want a belt-and-suspenders raise last_error or RuntimeError(...).

Nothing here blocks merge. Point #1 is the only one I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it.

github-actions · 2026-08-31T23:31:14Z

Claude finished @tanvikab4's task in 1m 18s —— View job

PR Review: private-hub Models & aliased references for ModelTrainer

Read the PR diff
Review document.py change (correctness)
Check accessors.py for the pattern it claims to mirror
Review new unit & integ tests
Post review

The fix is well-targeted and the root-cause analysis is correct: guessing hub_content_type from the hub name is wrong because a private hub can hold either a ModelReference or an owned Model. Probing + honoring hub_content_name is the right shape, and the test coverage (unit probe/alias/fallback, mocked gated-EULA defaults, and real integ tests) is thorough. Already has two approvals; nothing below blocks merge.

(The inline-comment tool wasn't available this run, so findings are listed with file/line refs.)

1. Fallback catch is narrower than the `accessors.py` path it claims to mirror — could break the private-owned-Model case

sagemaker-core/src/sagemaker/core/jumpstart/document.py:85-89

exceptClientErrorase:
ife.response["Error"]["Code"] =="ResourceNotFound":
last_error=econtinueraisee

The comment says this "mirrors ModelBuilder's resolution in accessors.py," but accessors.py:303 catches a broad Exception on the ModelReference probe and falls back to Model on any failure. Here, the fallback to Model only runs when the ModelReference lookup returns exactly ResourceNotFound.

The core case this PR enables — a privately-owned Model — depends on the ModelReference probe missing so the Model probe runs. If DescribeHubContent with HubContentType=ModelReference against a name that exists only as a Model returns anything other than ResourceNotFound (e.g. ValidationException), this re-raises immediately and never tries Model. test_private_hub_falls_back_to_model hard-codes _not_found() (ResourceNotFound), so it wouldn't catch that — only the gated/scheduled integ test would, and that doesn't run on PR CI.

The narrow catch is defensible (it avoids swallowing throttling/auth errors, which the broad except Exception arguably shouldn't). But please either (a) confirm the service actually returns ResourceNotFound for a wrong-HubContentType describe, or (b) add ValidationException to the fallback set — and either way, drop or soften the "mirrors accessors.py" comment since the behavior deliberately differs.

2. Minor: unnecessary `getattr`

sagemaker-core/src/sagemaker/core/jumpstart/document.py:56-60

hub_content_name is a declared field on JumpStartConfig (configs.py:51, a frozen extra="forbid" model), so it always exists. Simplify:

hub_content_name=jumpstart_config.hub_content_nameorjumpstart_config.model_id

Non-blocking.

3. Minor: `raise last_error` relies on an implicit invariant

sagemaker-core/src/sagemaker/core/jumpstart/document.py:98

Safe today — content_types_to_try is never empty and last_error is always set before hub_content is None is reached. Just noting raise None would surface as a confusing TypeError if that invariant ever broke; a raise last_error or RuntimeError(...) would be belt-and-suspenders. Not worth changing on its own.

Point #1 is the only thing I'd want an answer on before relying on the private-owned-Model path in production, since PR CI won't exercise it. Everything else is optional polish.

tanvikab4 had a problem deploying to manual-approval August 21, 2026 16:55 — with GitHub Actions Error

tanvikab4 had a problem deploying to manual-approval August 24, 2026 14:18 — with GitHub Actions Error

tanvikab4 had a problem deploying to manual-approval August 24, 2026 14:19 — with GitHub Actions Error

tanvikab4 requested a deployment to manual-approval August 25, 2026 14:23 — with GitHub Actions Waiting

tanvikab4 had a problem deploying to manual-approval August 25, 2026 14:23 — with GitHub Actions Error

Narrohag reviewed Aug 25, 2026
View reviewed changes

sahilper reviewed Aug 25, 2026
View reviewed changes

tanvikab4 had a problem deploying to manual-approval August 25, 2026 18:47 — with GitHub Actions Error

tanvikab4 requested a review from sahilper August 25, 2026 19:21

tanvikab4 had a problem deploying to manual-approval August 27, 2026 16:07 — with GitHub Actions Error

tanvikab4 force-pushed the fix/jumpstart-private-hub-modeltrainer branch from b96a38b to b0a2b7bCompare August 27, 2026 16:08

tanvikab4 had a problem deploying to manual-approval August 27, 2026 16:08 — with GitHub Actions Error

sahilper approved these changes Aug 27, 2026
View reviewed changes

tanvikab4 requested a review from Narrohag August 27, 2026 17:05

tanvikab4 force-pushed the fix/jumpstart-private-hub-modeltrainer branch from b0a2b7b to f66b654Compare August 27, 2026 19:54

tanvikab4 had a problem deploying to manual-approval August 27, 2026 19:54 — with GitHub Actions Error

Narrohag approved these changes Aug 27, 2026
View reviewed changes

tanvikab4 deployed to manual-approval August 27, 2026 20:06 — with GitHub Actions Active

tanvikab4 force-pushed the fix/jumpstart-private-hub-modeltrainer branch from b5afc72 to 1d87d98Compare August 31, 2026 19:58

fix: resolve private hub Models and aliased references for ModelTrainer
f67a2ab

tanvikab4 force-pushed the fix/jumpstart-private-hub-modeltrainer branch from 1d87d98 to f67a2abCompare August 31, 2026 20:06

tanvikab4 deployed to manual-approval August 31, 2026 20:44 — with GitHub Actions Active