ai-hub (#3)

Reviewed-on: #3

README.md

@@ -65,6 +65,17 @@ sagemaker:
     entry_point: null       # Optional: script inside source_dir
     source_dir: null        # Optional: local dir packaged and uploaded automatically
     hyperparameters: {}
+
+aihub:
+  device: Samsung Galaxy S25 (Family)
+  target_runtime: tflite
+  input_specs: {}           # Required before running qc-cli ai-hub commands
+  job_name: null            # Optional prefix for AI Hub Workbench jobs
+  model_name: null          # Optional name for uploaded local ONNX models
+  compile_options: null
+  profile_options: null
+  quantize_options: null
+  output_dir: build/qai-hub
 ```
 
 `qc-cli init` generates the `infra.stack_name` and `s3.bucket` namespace once and writes it to `config.yaml`. Keep these values stable for a deployment; changing them points the CLI at different infrastructure.
@@ -155,6 +166,35 @@ qc-cli train list --limit 3     Show a custom number of recent jobs
 
 The expected output artifact is SageMaker’s `model.tar.gz`, normally containing the trained model file your container writes to `/opt/ml/model`.
 
+### `ai-hub`
+
+```
+qc-cli ai-hub upload <calibration.npz|calibration-dir> <inputs.npz|inputs.npy>
+qc-cli ai-hub upload <calibration> <inputs> --from-step validate
+qc-cli ai-hub quantize <calibration.npz|calibration-dir> [--onnx-path PATH] [--model-s3-uri URI] [--from-job NAME]
+qc-cli ai-hub compile [--model-id ID] [--onnx-path PATH] [--model-s3-uri URI] [--from-job NAME]
+qc-cli ai-hub validate <inputs.npz|inputs.npy> [--model-id ID] [--input-name NAME]
+qc-cli ai-hub profile [--model-id ID]
+qc-cli ai-hub download [--model-id ID] [--output PATH]
+```
+
+`ai-hub upload` runs the four Workbench upload steps in order: quantize, compile, validate, and profile. Use `--from-step compile`, `--from-step validate`, or `--from-step profile` to resume from saved local state after a completed earlier step.
+
+Resume behavior:
+
+```text
+--from-step quantize  Run quantize, compile, validate, and profile.
+--from-step compile   Skip quantize; compile the last quantized model unless an explicit source is passed.
+--from-step validate  Skip quantize and compile; validate the last compiled model.
+--from-step profile   Skip quantize, compile, and validate; profile the last compiled model.
+```
+
+When a step runs in the current command, `upload` passes its returned model ID directly to the next step. When a step is skipped, the next step resolves the needed model ID from `.qc-cli.json`. This avoids re-running earlier AI Hub jobs when you only need to continue from a later step.
+
+`ai-hub compile` resolves model sources in this order: `--model-id`, explicit source options (`--onnx-path`, `--model-s3-uri`, `--from-job`), last quantized model from state, then the last training job from local state. `ai-hub download` is separate because downloading the optimized artifact is outside the four-step Workbench upload loop.
+
+AI Hub authentication currently uses the local `qai-hub` SDK configuration. A planned follow-up is to support AWS Systems Manager Parameter Store `SecureString` for team-managed tokens, where `config.yaml` stores only a parameter name such as `/qc-cli/aihub/token`, AWS KMS encrypts the token at rest, and the CLI retrieves it at runtime with `ssm:GetParameter` plus `kms:Decrypt` permissions.
+
 ## Model lifecycle
 
 The CLI uses neutral experiment naming for trained artifacts and reserves release terminology for an explicit promotion step.
@@ -168,12 +208,9 @@ Current behavior:
    - `qc_cli.artifact_kind=trained_source`
    - `qc_cli.source=sagemaker`
 4. The MLflow alias `experiment-latest` points at the most recently registered experiment version.
+5. AI Hub upload commands create deployable derived artifacts from a trained-source experiment or local ONNX model.
 
-Planned AI Hub extension:
-
-1. AI Hub compile or quantize will create deployable derived artifacts from a trained-source experiment.
-2. Derived artifacts will keep lineage back to the source experiment version instead of replacing it.
-3. Release aliases such as `v1` or `production` will point at the selected deployable artifact.
+Future release aliases such as `v1` or `production` can point at a selected deployable artifact.
 
 Example future metadata: