diff --git a/.github/workflows/contract-service.yml b/.github/workflows/contract-service.yml
index 7e19ece..ffe706e 100644
--- a/.github/workflows/contract-service.yml
+++ b/.github/workflows/contract-service.yml
@@ -15,7 +15,7 @@ env:
   CONTAINER_REGISTRY_USERNAME: ${{ secrets.CONTAINER_REGISTRY_USERNAME }}
   CONTAINER_REGISTRY_PASSWORD: ${{ secrets.CONTAINER_REGISTRY_ACCESS_TOKEN }}
   PLATFORM: "virtual"
-  CONTAINER_NAME: "contract-ledger"
+  CONTAINER_NAME: "contract-service"
 
 jobs:    
   deploy-contract-service:
diff --git a/README.md b/README.md
index 552bd4e..b0b476a 100644
--- a/README.md
+++ b/README.md
@@ -1,12 +1,18 @@
 # DEPA for Training
 
-[DEPA for Training](https://depa.world) is a techno-legal framework that enables privacy-preserving sharing of bulk, de-identified datasets for large scale analytics and training. This repository contains a reference implementation of [Confidential Clean Rooms](https://depa.world/training/confidential_clean_room_design), which together with the [Contract Service](https://github.com/kapilvgit/contract-ledger/tree/main), forms the basis of this framework. The reference implementation is provided on an As-Is basis. It is work-in-progress and should not be used in production.
+[DEPA for Training](https://depa.world) is a techno-legal framework that enables privacy-preserving sharing of bulk, de-identified datasets for large scale analytics and training. This repository contains a reference implementation of [Confidential Clean Rooms](https://depa.world/training/confidential_clean_room_design) (CCR), which together with the [Contract Service](https://github.com/iSPIRT/contract-service/tree/main), forms the basis of this framework. The reference implementation is provided on an As-Is basis. It is work-in-progress and should not be used in production.
 
 # Getting Started
 
+## [New] Interactive Demo
+
+You can now try out DEPA-Training interactively using our [interactive GUI demo](./gui-demo/README.md). The demo requires a signed electronic contract and an Azure cloud subscription.
+
+Start by setting up this project on GitHub Codespaces or your own development environment and then follow the [instructions](./gui-demo/README.md).
+
 ## GitHub Codespaces
 
-The simplest way to setup a development environment is using [GitHub Codespaces](https://github.com/codespaces). The repository includes a [devcontainer.json](.devcontainer/devcontainer.json), which customizes your codespace to install all required dependencies. Please ensure you allocate at least 8 vCPUs and 64GB disk space in your codespace. Also, run the following command in the codespace to update submodules.
+The simplest way to set up a development environment is using [GitHub Codespaces](https://github.com/codespaces). The repository includes a [devcontainer.json](.devcontainer/devcontainer.json), which customizes your codespace to install all required dependencies. Please ensure you allocate at least 8 vCPUs and 64GB disk space in your codespace. Also, run the following command in the codespace to update submodules.
 
 ```bash
 git submodule update --init --recursive
@@ -14,16 +20,16 @@ git submodule update --init --recursive
 
 ## Local Development Environment
 
-Alternatively, you can build and develop locally in a Linux environment (we have tested with Ubuntu 20.04 and 22.04), or Windows with WSL 2. 
+Alternatively, you can build and develop locally in a Linux environment (we have tested with Ubuntu 20.04, 22.04, 24.04), or Windows with WSL 2.
 
-Clone this repo to your local machine / virtual machine as follows. 
+Clone this repo to your local machine / virtual machine as follows.
 
 ```bash
 git clone --recursive http://github.com/iSPIRT/depa-training
 cd depa-training
 ```
 
-Install the below listed dependencies by running the [install-prerequisites.sh](./install-prerequisites.sh) script.
+Install the required dependencies by running the [install-prerequisites.sh](./install-prerequisites.sh) script.
 
 ```bash
 ./install-prerequisites.sh
@@ -33,18 +39,19 @@ Note: You may need to restart your machine to ensure that the changes take effec
 
 ## Build CCR containers
 
-To build your own CCR container images, use the following command from the root of the repository. 
+To build your own Confidential Cleanroom (CCR) container images, use the following command from the root of the repository.
 
 ```bash
 ./ci/build.sh
 ```
 
-This scripts build the following containers. 
+This scripts build the following containers.
+
+- ```depa-training```: Container with the core CCR logic for joining datasets and running differentially private training.
+- ```depa-training-encfs```: Container for loading encrypted data into the CCR.
 
-- ```depa-training```: Container with the core CCR logic for joining datasets and running differentially private training. 
-- ```depa-training-encfs```: Container for loading encrypted data into the CCR. 
+Alternatively, you can pull and use pre-built container images from the iSPIRT container registry by setting the following environment variable. Docker hub has started throttling which may affect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
 
-Alternatively, you can use pre-built container images from the ispirt repository by setting the following environment variable. Docker hub has started throttling which may effect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries, we are using azure container registry as shown below
 ```bash
 export CONTAINER_REGISTRY=ispirt.azurecr.io
 ./ci/pull-containers.sh
@@ -52,15 +59,15 @@ export CONTAINER_REGISTRY=ispirt.azurecr.io
 
 # Scenarios
 
-This repository contains two samples that illustrate the kinds of scenarios DEPA for Training can support. 
+This repository contains sample demos illustrating a diverse set of scenarios that DEPA for Training can support.
 
-Follow the links to build and deploy these scenarios. 
+Follow the links to build and deploy these scenarios.
 
-| Scenario name | Scenario type | Task type | Privacy | No. of TDPs* | Data type (format) | Model type (format) | Join type (No. of datasets) | 
+| Scenario name | Scenario type | Task type | Privacy | No. of TDPs* | Data type (format) | Model type (format) | Join type (No. of datasets) |
 |--------------|---------------|-----------------|--------------|-----------|------------|------------|------------|
 | [COVID-19](./scenarios/covid/README.md) | Training - Deep Learning | Binary Classification | Differentially Private | 3 | PII tabular data (CSV) | MLP (ONNX) | Horizontal (3)|
 | [BraTS](./scenarios/brats/README.md) | Training - Deep Learning | Image Segmentation | Differentially Private | 4 | MRI scans data (NIfTI/PNG) | UNet (Safetensors) | Vertical (4)|
-| [Credit Risk](./scenarios/credit-risk/README.md) | Training - Classical ML | Binary Classification | Differentially Private | 4 | PII tabular data (Parquet) | XGBoost (JSON) | Horizontal (4)|
+| [Credit Risk](./scenarios/credit-risk/README.md) | Training - Classical ML | Binary Classification | Differentially Private | 4 | PII tabular data (Parquet) | XGBoost (JSON) | Horizontal (6)|
 | [CIFAR-10](./scenarios/cifar10/README.md) | Training - Deep Learning | Multi-class Image Classification | NA | 1 | Non-PII image data (SafeTensors) | CNN (Safetensors) | NA (1)|
 | [MNIST](./scenarios/mnist/README.md) | Training - Deep Learning | Multi-class Image Classification | NA | 1 | Non-PII image data (HDF5) | CNN (ONNX) | NA (1)|
 
@@ -70,7 +77,7 @@ _*Training Data Providers (TDPs) involved in the scenario._
 
 ## Build your own Scenarios
 
-A guide to build your own scenarios is coming soon. Stay tuned!
+A guide to build your own scenarios is available [here](./build-your-own-scenario/README.md). Follow the steps to build and run your own unique training scenario!
 
 Currently, DEPA for Training supports the following training frameworks, libraries and file formats (more will be included soon):
 
@@ -85,4 +92,4 @@ Note: Due to security reasons, we do not support Pickle based file formats such
 
 This project welcomes feedback and contributions. Before you start, please take a moment to review our [Contribution Guidelines](./CONTRIBUTING.md). These guidelines provide information on how to contribute, set up your development environment, and submit your changes.
 
-We look forward to your contributions and appreciate your efforts in making DEPA Training better for everyone.
+We look forward to your contributions and appreciate your efforts in making DEPA Training better for everyone.
\ No newline at end of file
diff --git a/build-your-own-scenario/README.md b/build-your-own-scenario/README.md
new file mode 100644
index 0000000..4182f94
--- /dev/null
+++ b/build-your-own-scenario/README.md
@@ -0,0 +1,240 @@
+# Build Your Own Scenario
+
+## Overview
+
+You can build and run your own unique Training scenarios by following three simple steps:
+
+1. Define your high-level scenario configuration and generate a scenario boilerplate from it.
+2. Implement the data preprocessing and model saving code for the Training Data Providers (TDPs) and Training Data Consumer (TDC) respectively.
+3. Tailor the various training configuration files applicable to your scenario.
+
+Once the scenario is ready, deploy it locally and/or inside a Confidential Clean Room (CCR) following the standard deployment steps.
+
+## Step 1: Define and build your scenario template
+
+Make sure to first complete the setup steps mentioned in the main [README](../README.md) file.
+
+### Define your scenario configuration
+
+In the [config](./config/) directory, you will find example scenario configuration files. These files define the high-level scenario configuration -- the datasets owned by each TDP along with associated control parameters (such as privacy budget), the training framework to use, the data joining method to use, and the model format to save/load the model in. 
+
+In a similar fashion, you can define your own scenario configuration file following the generalized template below:
+
+```json
+{
+  "scenario_name": "your-scenario-name",
+  "tdps": [
+    {
+      "name": "data_provider_1",
+      "datasets": [
+        {
+          "name": "dataset_name",
+          "id": "unique/random-uuid-here",
+          "privacy": true|false,
+          "epsilon": 7.5|null,
+          "delta": 0.00001|null
+        }
+      ]
+    }
+  ],
+  "training_framework": "Train_DL|LLM_Finetune|Train_ML|Train_XGB",
+  "join_type": "SparkJoin|DirectoryJoin",
+  "model_format": "ONNX|Safetensors|HDF5|ccr_instantiate"
+}
+```
+
+### Configuration Fields
+
+- **scenario_name**: Unique name for your scenario (used for directory creation)
+- **tdps**: Array of Training Data Providers (TDPs)
+  - **name**: TDP identifier
+  - **datasets**: Array of datasets brought by this TDP
+    - **name**: Dataset name
+    - **id**: Unique UUID for the dataset
+    - **privacy**: (Optional) Boolean indicating if privacy protection is required
+    - **epsilon**: (Optional) Privacy budget (ε) for differential privacy
+    - **delta**: (Optional) Privacy parameter (δ) for differential privacy
+- **training_framework**: Training framework to use among available DEPA-Training options:
+  - `Train_DL`: Deep learning training
+  - `LLM_Finetune`: Fine-tuning of LLMs
+  - `Train_ML`: Classical machine learning training
+  - `Train_XGB`: XGBoost training
+- **join_type**: Data joining method to use among available DEPA-Training options:
+  - `SparkJoin`: Spark-based data joining
+  - `DirectoryJoin`: Directory-based data joining
+- **model_format**: Format of model brought by the TDC for training
+  - `ONNX`: Open Neural Network Exchange format
+  - `Safetensors`: Safetensors format
+  - `HDF5`: HDF5 format
+  - `ccr_instantiate`: Model is created inside the CCR (no file needed)
+
+### Generate your scenario directory
+
+Generate a scenario directory from your scenario configuration file, by running the `build-scenario.sh` script as follows:
+
+```bash
+./build-scenario.sh <path-to-scenario.json> [--force]
+```
+
+- `<path-to-scenario.json>`: Path to your scenario configuration JSON file
+- `--force`: Optional flag to overwrite existing scenario directories
+
+Example:
+
+```bash
+./build-scenario.sh config/credit-risk.json
+```
+
+### Generated Scenario Directory Structure
+
+```
+scenarios/your-scenario-name/
+├── ci/                         
+│   ├── Dockerfile.*            # Dockerfiles for each TDP to prepare datasets
+│   ├── Dockerfile.modelsave    # Dockerfiles for preparing base model (if applicable)
+│   ├── build.sh                # Build script for all containers
+│   ├── pull-containers.sh      # Container pulling script
+│   └── push-containers.sh      # Container pushing script
+├── src/                        
+│   ├── preprocess_*.py         # Preprocessing scripts for each TDP
+│   └── save_base_model.py      # Model saving script (if applicable)
+├── contract/                    
+│   └── contract.json           # Contract template
+├── policy/                      
+│   └── policy-in-template.json # Policy template
+├── config/                     
+│   ├── consolidate_pipeline.sh # Pipeline consolidation script
+│   ├── dataset_config.json     # Dataset configuration
+│   ├── eval_config.json        # Evaluation configuration
+│   ├── join_config.json        # Data joining configuration (if applicable)
+│   ├── model_config.json       # Model configuration (if applicable)
+│   ├── loss_config.json        # Loss function configuration (DL only)
+│   └── templates/              # Configuration templates for training pipeline
+│       ├── pipeline_config_template.json
+│       └── train_config_template.json
+├── deployment/                 
+│   ├── local/                  # Local deployment commands
+│   └── azure/                  # Azure deployment commands
+├── export-variables.sh         # Environment variables for deployment
+├── .gitignore                  # Git ignore file
+```
+
+## Step 2: Implement the data preprocessing and model saving code
+
+Prior to training, the Training Data Providers (TDPs) and Training Data Consumer (TDC) need to prepare their datasets and models respectively.
+
+### Data preprocessing
+
+The folder ```scenarios/your-scenario-name/src``` contains boilerplate scripts for pre-processing the datasets. Acting as a Training Data Provider (TDP), prepare your datasets by modifying the scripts according to your requirements.
+
+Corresponding Dockerfiles are also provided in the ```scenarios/your-scenario-name/ci``` directory. Modify the Dockerfiles to install the dependencies for your preprocessing scripts.
+
+### Model saving
+
+If the TDC intends to bring a base model file for training, a boilerplate script for saving the model is provided in the ```scenarios/your-scenario-name/src``` directory. Acting as a TDC, modify the script to save your model in an appropriate format.
+
+A corresponding Dockerfile is provided in the ```scenarios/your-scenario-name/ci``` directory. Modify the Dockerfile to install the dependencies for your model saving script.
+
+## Step 3: Tailor the training configuration
+
+The folder ```scenarios/your-scenario-name/config``` contains the training configuration files for the different training frameworks. Below is a list of configuration files that you can modify to suit your training requirements:
+
+- `train_config_template.json`: Training configuration template
+- `join_config.json`: Data joining configuration (applicable only if joining multiple datasets)
+- `dataset_config.json`: Dataset configuration
+- `model_config.json`: Model configuration (applicable for formats other than ONNX)
+- `loss_config.json`: Loss function configuration (applicable only for DL scenarios)
+- `eval_config.json`: Trained model validation configuration
+
+## Step 4: Deploy your scenario
+
+Now that you have the full scenario ready, you can deploy it following the same steps as the example scenarios:
+
+### Build scenario container images
+
+```bash
+export SCENARIO=your-scenario-name
+export REPO_ROOT="$(git rev-parse --show-toplevel)"
+cd $REPO_ROOT/scenarios/$SCENARIO
+./ci/build.sh
+```
+
+### Deploy locally
+
+Assuming you have cleartext access to all the datasets, you can train the model _locally_ as follows:
+
+```bash
+cd $REPO_ROOT/scenarios/$SCENARIO/deployment/local
+./preprocess.sh
+./save-model.sh
+./train.sh
+```
+
+### Deploy on CCR
+
+Once the training scenario executes successfully in the local environment, you can train the model inside a _Confidential Clean Room (CCR)_ as follows. This reference implementation assumes Azure as the cloud platform. Stay tuned for CCR on other cloud platforms.
+
+#### 1. Set up environment variables
+
+Set up the necessary environment variables for your deployment in the ```scenarios/your-scenario-name/export-variables.sh``` file and run it. This will set the environment variables in the current terminal.
+```bash
+cd $REPO_ROOT/scenarios/$SCENARIO
+./export-variables.sh
+source export-variables.sh
+```
+
+#### 2. Create resources
+
+```bash
+cd $REPO_ROOT/scenarios/$SCENARIO/deployment/azure
+./1-create-storage-containers.sh
+./2-create-akv.sh
+```
+
+#### 3. Contract signing
+
+Follow the instructions in the [contract-service](https://github.com/iSPIRT/contract-service/blob/main/README.md) repository for contract signing, using your scenario's contract template in `/scenarios/$SCENARIO/contract/contract.json`.
+
+Once the contract is signed, export the contract sequence number as an environment variable in the same terminal where you set the environment variables for the deployment.
+
+```bash
+export CONTRACT_SEQ_NO=<contract-sequence-number>
+```
+
+#### 4. Data encryption and upload
+
+```bash
+cd $REPO_ROOT/scenarios/$SCENARIO/deployment/azure
+./3-import-keys.sh
+./4-encrypt-data.sh
+./5-upload-encrypted-data.sh
+```
+
+#### 5. Deploy CCR
+
+```bash
+./deploy.sh -c $CONTRACT_SEQ_NO -p ../../config/pipeline_config.json
+```
+
+#### 6. Monitor container logs
+
+```bash
+az container logs \
+  --name "depa-training-$SCENARIO" \
+  --resource-group "$AZURE_RESOURCE_GROUP" \
+  --container-name depa-training
+```
+
+You will know training has completed when the logs print "CCR Training complete!".
+
+#### 7. Download and decrypt model
+
+```bash
+./6-download-decrypt-model.sh
+```
+
+The outputs will be saved to the ```scenarios/your-scenario-name/modeller/output``` directory.
+
+## Contribute
+
+Have a scenario that you think would be useful for others? Raise a Pull Request to contribute to the DEPA-Training project, following the [contribution guidelines](../CONTRIBUTING.md). Ensure that no personal/proprietary data, credentials or information is included in the code you submit.
diff --git a/build-your-own-scenario/build-scenario.sh b/build-your-own-scenario/build-scenario.sh
new file mode 100755
index 0000000..5446cda
--- /dev/null
+++ b/build-your-own-scenario/build-scenario.sh
@@ -0,0 +1,1659 @@
+#!/bin/bash
+
+# Usage:
+#   ./create-scenario.sh <path-to-scenario.json> [--force]
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "Error: jq is required. Install with: sudo apt-get install -y jq" >&2
+  exit 1
+fi
+
+if [ $# -lt 1 ]; then
+  echo "Usage: $0 <path-to-scenario.json> [--force]" >&2
+  exit 1
+fi
+
+INPUT_JSON="$1"
+FORCE="false"
+if [ "${2-}" = "--force" ]; then
+  FORCE="true"
+fi
+
+if [ ! -f "$INPUT_JSON" ]; then
+  echo "Error: JSON file not found: $INPUT_JSON" >&2
+  exit 1
+fi
+
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+
+# Extract scenario name
+SCENARIO_NAME="$(jq -r '.scenario_name' "$INPUT_JSON")"
+if [ -z "$SCENARIO_NAME" ] || [ "$SCENARIO_NAME" = "null" ]; then
+  echo "Error: scenario_name missing in $INPUT_JSON" >&2
+  exit 1
+fi
+
+SCENARIO_DIR="$REPO_ROOT/scenarios/$SCENARIO_NAME"
+if [ -d "$SCENARIO_DIR" ] && [ "$FORCE" != "true" ]; then
+  echo "Error: Scenario directory already exists: $SCENARIO_DIR (use --force to overwrite)" >&2
+  exit 1
+fi
+
+# Extract all TDP names
+TDP_NAMES=($(jq -r '.tdps[] | .name' "$INPUT_JSON"))
+if [ -z "$TDP_NAMES" ] || [ "$TDP_NAMES" = "null" ]; then
+  echo "Error: tdp_names missing in $INPUT_JSON" >&2
+  exit 1
+fi
+
+echo "Creating scenario: $SCENARIO_NAME"
+mkdir -p "$SCENARIO_DIR"
+
+# Basic layout
+mkdir -p "$SCENARIO_DIR/ci"
+mkdir -p "$SCENARIO_DIR/src"
+mkdir -p "$SCENARIO_DIR/policy"
+mkdir -p "$SCENARIO_DIR/contract"
+mkdir -p "$SCENARIO_DIR/config/templates"
+mkdir -p "$SCENARIO_DIR/deployment/azure"
+mkdir -p "$SCENARIO_DIR/deployment/local"
+
+
+######## Create ci and src ########
+
+MODEL_FORMAT="$(jq -r '.model_format' "$INPUT_JSON")"
+TRAIN_METHOD="$(jq -r '.training_framework' "$INPUT_JSON")"
+JOIN_TYPE="$(jq -r '.join_type' "$INPUT_JSON")"
+
+# Generate Dockerfiles and preprocess scripts for each TDP
+for TDP in "${TDP_NAMES[@]}"; do
+  CLEAN_NAME=$(echo "$TDP" | tr -d '_' | tr -d '-')  # remove _ and -
+  DOCKERFILE="$SCENARIO_DIR/ci/Dockerfile.${CLEAN_NAME}"
+  PREPROCESS="$SCENARIO_DIR/src/preprocess_${TDP}.py"
+
+  # Generate Dockerfile
+  cat > "$DOCKERFILE" <<EOF
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND="noninteractive"
+
+RUN apt-get update && apt-get -y upgrade \\
+    && apt-get install -y curl \\
+    && apt-get install -y python3 python3-dev python3-distutils 
+
+## Install pip
+RUN curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
+RUN python3 get-pip.py
+
+## Install dependencies
+# RUN pip3 install
+
+COPY preprocess_${TDP}.py preprocess_${TDP}.py
+EOF
+
+  # Generate preprocess script
+  cat > "$PREPROCESS" <<EOF
+# TODO: Add your library imports here
+import os
+
+input_dir = "/mnt/input/data"
+output_dir = "/mnt/output/preprocessed"
+os.makedirs(output_dir, exist_ok=True)
+
+# TODO: Implement your data processing code here
+
+EOF
+done
+
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+    # Generate Dockerfile.modelsave
+    cat > "$SCENARIO_DIR/ci/Dockerfile.modelsave" <<EOF
+FROM ubuntu:22.04
+
+ENV DEBIAN_FRONTEND="noninteractive"
+
+RUN apt-get update && apt-get -y upgrade \\
+    && apt-get install -y curl \\
+    && apt-get install -y python3 python3-dev python3-distutils 
+
+## Install pip
+RUN curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
+RUN python3 get-pip.py
+
+## Install dependencies
+# RUN pip3 install
+
+COPY save_base_model.py save_base_model.py
+EOF
+
+    # Generate save_base_model.py
+    cat > "$SCENARIO_DIR/src/save_base_model.py" <<EOF
+# TODO: Add your library imports here
+import os
+
+save_dir = "/mnt/model"
+os.makedirs(save_dir, exist_ok=True)
+
+# TODO: Implement model instantiation and saving logic here
+
+EOF
+fi
+
+# Generate build.sh
+BUILD_SCRIPT="$SCENARIO_DIR/ci/build.sh"
+echo '#!/bin/bash' > "$BUILD_SCRIPT"
+for TDP in "${TDP_NAMES[@]}"; do
+  # remove _ and -
+  CLEAN_NAME=$(echo "$TDP" | tr -d '_' | tr -d '-')
+  # replace _ with -
+  TDP_SUFFIX=$(echo "$TDP" | tr '_' '-' | tr '[:upper:]' '[:lower:]')
+  SCENARIO_PREFIX=$(echo "$SCENARIO_NAME" | tr '_' '-')
+  echo "docker build -f ci/Dockerfile.${CLEAN_NAME} src -t preprocess-${TDP_SUFFIX}:latest" >> "$BUILD_SCRIPT"
+done
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+    echo "docker build -f ci/Dockerfile.modelsave src -t ${SCENARIO_PREFIX}-model-save:latest" >> "$BUILD_SCRIPT"
+fi
+chmod +x "$BUILD_SCRIPT"
+
+# Generate pull-containers.sh
+PULL_SCRIPT="$SCENARIO_DIR/ci/pull-containers.sh"
+echo '#!/bin/bash' > "$PULL_SCRIPT"
+for TDP in "${TDP_NAMES[@]}"; do
+  CLEAN_NAME=$(echo "$TDP" | tr -d '_' | tr -d '-')
+  TDP_SUFFIX=$(echo "$CLEAN_NAME" | tr '_' '-' | tr '[:upper:]' '[:lower:]')
+  echo "docker pull \$CONTAINER_REGISTRY/preprocess-${TDP_SUFFIX}:latest" >> "$PULL_SCRIPT"
+done
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+    echo "docker pull \$CONTAINER_REGISTRY/${SCENARIO_PREFIX}-model-save:latest" >> "$PULL_SCRIPT"
+fi
+chmod +x "$PULL_SCRIPT"
+
+# Generate push-containers.sh
+PUSH_SCRIPT="$SCENARIO_DIR/ci/push-containers.sh"
+echo '#!/bin/bash' > "$PUSH_SCRIPT"
+for TDP in "${TDP_NAMES[@]}"; do
+  CLEAN_NAME=$(echo "$TDP" | tr -d '_' | tr -d '-')
+  TDP_SUFFIX=$(echo "$CLEAN_NAME" | tr '_' '-' | tr '[:upper:]' '[:lower:]')
+  echo "docker tag preprocess-${TDP_SUFFIX}:latest \$CONTAINER_REGISTRY/preprocess-${TDP_SUFFIX}:latest" >> "$PUSH_SCRIPT"
+  echo "docker push \$CONTAINER_REGISTRY/preprocess-${TDP_SUFFIX}:latest" >> "$PUSH_SCRIPT"
+done
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+    echo "docker tag ${SCENARIO_PREFIX}-model-save:latest \$CONTAINER_REGISTRY/${SCENARIO_PREFIX}-model-save:latest" >> "$PUSH_SCRIPT"
+    echo "docker push \$CONTAINER_REGISTRY/${SCENARIO_PREFIX}-model-save:latest" >> "$PUSH_SCRIPT"
+fi
+
+chmod +x "$PUSH_SCRIPT"
+
+
+######## Create contract ########
+
+OUTPUT_FILE="$SCENARIO_DIR/contract/contract.json"
+
+# Random contract UUID
+CONTRACT_ID=$(uuidgen)
+
+# Begin contract object
+jq -n \
+  --arg id "$CONTRACT_ID" \
+  --arg schemaVersion "0.1" \
+  --arg startTime "2025-09-14T00:00:00.000Z" \
+  --arg expiryTime "2025-10-14T00:00:00.000Z" \
+  --arg purpose "TRAINING" \
+  '
+  {
+    id: $id,
+    schemaVersion: $schemaVersion,
+    startTime: $startTime,
+    expiryTime: $expiryTime,
+    tdc: "",
+    tdps: [],
+    ccrp: "did:web:$CCRP_USERNAME.github.io",
+    datasets: [],
+    purpose: $purpose,
+    constraints: [ { privacy: [] } ],
+    terms: { payment: {}, revocation: {} }
+  }
+  ' > "$OUTPUT_FILE"
+
+# Iterate datasets and append
+jq -c '.tdps[] | {tdp: .name, datasets: .datasets}' "$INPUT_JSON" | while read -r entry; do
+  TDP_NAME=$(echo "$entry" | jq -r '.tdp')
+  DATASETS=$(echo "$entry" | jq -c '.datasets[]')
+  
+  for ds in $DATASETS; do
+    DS_ID=$(echo "$ds" | jq -r '.id')
+    DS_NAME=$(echo "$ds" | jq -r '.name')
+
+    # Epsilon and delta are optional
+    EPS=$([[ "$ds" =~ .*epsilon.* ]] && echo "$ds" | jq -r '.epsilon' || echo "null") # if epsilon is present, use it, otherwise set to null
+    DELTA=$([[ "$ds" =~ .*delta.* ]] && echo "$ds" | jq -r '.delta' || echo "null") # if delta is present, use it, otherwise set to null
+
+    # Uppercase container name
+    UPPER_NAME=$(echo "$TDP_NAME" | tr '[:lower:]' '[:upper:]')
+
+    # Key kid (BankA → BankAFilesystemEncryptionKey)
+    KEY_KID="$(echo "$TDP_NAME" | sed -E 's/(^|_)([a-z])/\U\2/g')FilesystemEncryptionKey"
+
+    # Dataset JSON
+    DATASET_OBJ=$(jq -n \
+      --arg id "$DS_ID" \
+      --arg name "$DS_NAME" \
+      --arg owner "$TDP_NAME" \
+      --arg url "https://\$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/\$AZURE_${UPPER_NAME}_CONTAINER_NAME/data.img" \
+      --arg provider "" \
+      --arg kid "$KEY_KID" \
+      '
+      {
+        id: $id,
+        name: $name,
+        owner: $owner,
+        url: $url,
+        provider: $provider,
+        key: {
+          type: "azure",
+          properties: {
+            kid: $kid,
+            authority: { endpoint: "sharedneu.neu.attest.azure.net" },
+            endpoint: ""
+          }
+        }
+      }
+      ')
+
+    # Privacy JSON
+    PRIVACY_OBJ=$(jq -n \
+      --arg dataset "$DS_ID" \
+      --arg eps "$EPS" \
+      --arg delta "$DELTA" \
+      '{ dataset: $dataset, epsilon_threshold: $eps, delta: $delta }')
+
+    # Append into contract.json
+    tmp=$(mktemp)
+    jq \
+      --argjson dataset "$DATASET_OBJ" \
+      --argjson privacy "$PRIVACY_OBJ" \
+      '.datasets += [$dataset] | .constraints[0].privacy += [$privacy]' \
+      "$OUTPUT_FILE" > "$tmp" && mv "$tmp" "$OUTPUT_FILE"
+  done
+done
+
+
+
+######## Create policy ########
+
+POLICY_FILE="$SCENARIO_DIR/policy/policy-in-template.json"
+
+jq -n \
+  '
+  {
+    version: "1.0",
+    containers: [
+      {
+        containerImage: "$CONTAINER_REGISTRY/depa-training:latest",
+        command: [
+          "/bin/bash",
+          "run.sh"
+        ],
+        environmentVariables: [],
+        mounts: [
+          {
+            mountType: "emptyDir",
+            mountPath: "/mnt/remote",
+            readonly: false
+          }
+        ]
+      },
+      {
+        containerImage: "$CONTAINER_REGISTRY/depa-training-encfs:latest",
+        environmentVariables: [
+          {
+            name: "EncfsSideCarArgs",
+            value: ".+",
+            strategy: "re2"
+          },
+          {
+            name: "ContractService",
+            value: ".+",
+            strategy: "re2"
+          },
+          {
+            name: "ContractServiceParameters",
+            value: "$CONTRACT_SERVICE_PARAMETERS",
+            strategy: "string"
+          },
+          {
+            name: "Contracts",
+            value: ".+",
+            strategy: "re2"
+          },
+          {
+            name: "PipelineConfiguration",
+            value: ".+",
+            strategy: "re2"
+          }
+        ],
+        command: [
+          "/encfs.sh"
+        ],
+        securityContext: {
+          privileged: "true"
+        },
+        mounts: [
+          {
+            mountType: "emptyDir",
+            mountPath: "/mnt/remote",
+            readonly: false
+          }
+        ]
+      }
+    ]
+  }
+  ' > "$POLICY_FILE"
+
+
+######## Create deployment/azure ########
+
+# 1-create-storage-containers.sh
+
+AZ_SCRIPT_1="$SCENARIO_DIR/deployment/azure/1-create-storage-containers.sh"
+
+echo '#!/bin/bash
+
+echo "Checking if resource group $AZURE_RESOURCE_GROUP exists..."
+RG_EXISTS=$(az group exists --name $AZURE_RESOURCE_GROUP)
+
+if [ "$RG_EXISTS" == "false" ]; then
+  echo "Resource group $AZURE_RESOURCE_GROUP does not exist. Creating it now..."
+  # Create the resource group
+  az group create --name $AZURE_RESOURCE_GROUP --location $AZURE_LOCATION
+else
+  echo "Resource group $AZURE_RESOURCE_GROUP already exists. Skipping creation."
+fi
+
+echo "Check if storage account $STORAGE_ACCOUNT_NAME exists..."
+STORAGE_ACCOUNT_EXISTS=$(az storage account check-name --name $AZURE_STORAGE_ACCOUNT_NAME --query "nameAvailable" --output tsv)
+
+if [ "$STORAGE_ACCOUNT_EXISTS" == "true" ]; then
+  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME does not exist. Creating it now..."
+  az storage account create  --resource-group $AZURE_RESOURCE_GROUP  --name $AZURE_STORAGE_ACCOUNT_NAME
+else
+  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists. Skipping creation."
+fi
+
+# Get the storage account key
+ACCOUNT_KEY=$(az storage account keys list --resource-group $AZURE_RESOURCE_GROUP --account-name $AZURE_STORAGE_ACCOUNT_NAME --query "[0].value" --output tsv)
+
+' > "$AZ_SCRIPT_1"
+
+TDP_NAMES=($(jq -r '.tdps[] | .name' "$INPUT_JSON"))
+for TDP in "${TDP_NAMES[@]}"; do
+  UPPER_NAME=$(echo "$TDP" | tr '[:lower:]' '[:upper:]')
+  cat >> "$AZ_SCRIPT_1" <<EOF
+# Check if the ${UPPER_NAME} container exists
+CONTAINER_EXISTS=\$(az storage container exists --name \$AZURE_${UPPER_NAME}_CONTAINER_NAME --account-name \$AZURE_STORAGE_ACCOUNT_NAME --account-key \$ACCOUNT_KEY --query "exists" --output tsv)
+
+if [ "\$CONTAINER_EXISTS" == "false" ]; then
+    echo "Container \$AZURE_${UPPER_NAME}_CONTAINER_NAME does not exist. Creating it now..."
+    az storage container create --resource-group \$AZURE_RESOURCE_GROUP --account-name \$AZURE_STORAGE_ACCOUNT_NAME --name \$AZURE_${UPPER_NAME}_CONTAINER_NAME --account-key \$ACCOUNT_KEY
+fi
+
+EOF
+done
+
+
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+    cat >> "$AZ_SCRIPT_1" <<'EOF'
+# Check if the MODEL container exists
+CONTAINER_EXISTS=$(az storage container exists --name $AZURE_MODEL_CONTAINER_NAME --account-name $AZURE_STORAGE_ACCOUNT_NAME --account-key $ACCOUNT_KEY --query "exists" --output tsv)
+
+if [ "$CONTAINER_EXISTS" == "false" ]; then
+echo "Container $AZURE_MODEL_CONTAINER_NAME does not exist. Creating it now..."
+az storage container create --resource-group $AZURE_RESOURCE_GROUP --account-name $AZURE_STORAGE_ACCOUNT_NAME --name $AZURE_MODEL_CONTAINER_NAME --account-key $ACCOUNT_KEY
+fi
+
+EOF
+fi
+
+cat >> "$AZ_SCRIPT_1" <<'EOF'
+# Check if the OUTPUT container exists
+CONTAINER_EXISTS=$(az storage container exists --name $AZURE_OUTPUT_CONTAINER_NAME --account-name $AZURE_STORAGE_ACCOUNT_NAME --account-key $ACCOUNT_KEY --query "exists" --output tsv)
+
+if [ "$CONTAINER_EXISTS" == "false" ]; then
+  echo "Container $AZURE_OUTPUT_CONTAINER_NAME does not exist. Creating it now..."
+  az storage container create --resource-group $AZURE_RESOURCE_GROUP --account-name $AZURE_STORAGE_ACCOUNT_NAME --name $AZURE_OUTPUT_CONTAINER_NAME --account-key $ACCOUNT_KEY
+fi
+EOF
+
+chmod +x "$AZ_SCRIPT_1"
+
+
+# 2-create-akv.sh
+
+AZ_SCRIPT_2="$SCENARIO_DIR/deployment/azure/2-create-akv.sh"
+
+cat > "$AZ_SCRIPT_2" <<EOF
+#!/bin/bash
+
+set -e 
+
+if [[ "\$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then 
+    AZURE_AKV_RESOURCE_NAME=\`echo \$AZURE_KEYVAULT_ENDPOINT | awk '{split(\$0,a,"."); print a[1]}'\`
+    # Check if the Key Vault already exists
+    echo "Checking if Key Vault \$AZURE_AKV_RESOURCE_NAME exists..."
+    NAME_AVAILABLE=\$(az rest --method post \
+        --uri "https://management.azure.com/subscriptions/\$AZURE_SUBSCRIPTION_ID/providers/Microsoft.KeyVault/checkNameAvailability?api-version=2019-09-01" \
+        --headers "Content-Type=application/json" \
+        --body "{\"name\": \"\$AZURE_AKV_RESOURCE_NAME\", \"type\": \"Microsoft.KeyVault/vaults\"}" | jq -r '.nameAvailable')
+    if [ "\$NAME_AVAILABLE" == true ]; then
+        echo "Key Vault \$AZURE_AKV_RESOURCE_NAME does not exist. Creating it now..."
+        echo CREATING \$AZURE_KEYVAULT_ENDPOINT in resource group \$AZURE_RESOURCE_GROUP
+        # Create Azure key vault with RBAC authorization
+        az keyvault create --name \$AZURE_AKV_RESOURCE_NAME --resource-group \$AZURE_RESOURCE_GROUP --sku "Premium" --enable-rbac-authorization
+        # Assign RBAC roles to the resource owner so they can import keys
+        AKV_SCOPE=\`az keyvault show --name \$AZURE_AKV_RESOURCE_NAME --query id --output tsv\`    
+        az role assignment create --role "Key Vault Crypto Officer" --assignee \`az account show --query user.name --output tsv\` --scope \$AKV_SCOPE
+        az role assignment create --role "Key Vault Crypto User" --assignee \`az account show --query user.name --output tsv\` --scope \$AKV_SCOPE
+    else
+        # Name is not available — check if the vault exists in *this* subscription
+        if az keyvault show --name \$AZURE_AKV_RESOURCE_NAME --resource-group \$AZURE_RESOURCE_GROUP >/dev/null 2>&1; then
+            echo "Key Vault \$AZURE_AKV_RESOURCE_NAME already exists in your subscription. Skipping creation."
+        else
+            echo "Key Vault name '\$AZURE_AKV_RESOURCE_NAME' is already reserved."
+            echo "If you previously owned this Key Vault, it may be soft-deleted."
+            echo "Please purge the Key Vault before retrying."
+            exit 1
+        fi
+    fi
+else
+    echo "Automated creation of key vaults is supported only for vaults"
+fi
+
+EOF
+
+chmod +x "$AZ_SCRIPT_2"
+
+
+# 3-import-keys.sh
+
+AZ_SCRIPT_3="$SCENARIO_DIR/deployment/azure/3-import-keys.sh"
+
+cat > "$AZ_SCRIPT_3" <<EOF
+#!/bin/bash
+
+# Function to import a key with a given key ID and key material into AKV
+# The key is bound to a key release policy with host data defined in the environment variable CCE_POLICY_HASH
+function import_key() {
+  export KEYID=\$1
+  export KEYFILE=\$2
+
+  # For RSA-HSM keys, we need to set a salt and label which will be used in the symmetric key derivation
+  if [ "\$AZURE_AKV_KEY_TYPE" = "RSA-HSM" ]; then    
+    export AZURE_AKV_KEY_DERIVATION_LABEL=\$KEYID
+  fi
+
+  CONFIG=\$(jq '.claims[0][0].equals = env.CCE_POLICY_HASH' importkey-config-template.json)
+  CONFIG=\$(echo \$CONFIG | jq '.key.kid = env.KEYID')
+  CONFIG=\$(echo \$CONFIG | jq '.key.kty = env.AZURE_AKV_KEY_TYPE')
+  CONFIG=\$(echo \$CONFIG | jq '.key_derivation.salt = "9b53cddbe5b78a0b912a8f05f341bcd4dd839ea85d26a08efaef13e696d999f4"')
+  CONFIG=\$(echo \$CONFIG | jq '.key_derivation.label = env.AZURE_AKV_KEY_DERIVATION_LABEL')
+  CONFIG=\$(echo \$CONFIG | jq '.key.akv.endpoint = env.AZURE_KEYVAULT_ENDPOINT')
+  CONFIG=\$(echo \$CONFIG | jq '.key.akv.bearer_token = env.BEARER_TOKEN')
+  echo \$CONFIG > /tmp/importkey-config.json
+  echo "Importing \$KEYID key with key release policy"
+  jq '.key.akv.bearer_token = "REDACTED"' /tmp/importkey-config.json
+  pushd . && cd \$TOOLS_HOME/importkey && go run main.go -c /tmp/importkey-config.json -out && popd
+  mv \$TOOLS_HOME/importkey/keyfile.bin \$KEYFILE
+}
+
+echo Obtaining contract service parameters...
+CONTRACT_SERVICE_URL=\${CONTRACT_SERVICE_URL:-"http://localhost:8000"}
+export CONTRACT_SERVICE_PARAMETERS=\$(curl -k -f \$CONTRACT_SERVICE_URL/parameters | base64 --wrap=0)
+
+envsubst < ../../policy/policy-in-template.json > /tmp/policy-in.json
+export CCE_POLICY=\$(az confcom acipolicygen -i /tmp/policy-in.json --debug-mode)
+export CCE_POLICY_HASH=\$(go run \$TOOLS_HOME/securitypolicydigest/main.go -p \$CCE_POLICY)
+echo "Training container policy hash \$CCE_POLICY_HASH"
+
+# Obtain the token based on the AKV resource endpoint subdomain
+if [[ "\$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then
+    export BEARER_TOKEN=\$(az account get-access-token --resource https://vault.azure.net | jq -r .accessToken)
+    echo "Importing keys to AKV key vaults can be only of type RSA-HSM"
+    export AZURE_AKV_KEY_TYPE="RSA-HSM"
+elif [[ "\$AZURE_KEYVAULT_ENDPOINT" == *".managedhsm.azure.net" ]]; then
+    export BEARER_TOKEN=\$(az account get-access-token --resource https://managedhsm.azure.net | jq -r .accessToken)    
+    export AZURE_AKV_KEY_TYPE="oct-HSM"
+fi
+
+DATADIR=\$REPO_ROOT/scenarios/\$SCENARIO/data
+MODELDIR=\$REPO_ROOT/scenarios/\$SCENARIO/modeller
+
+EOF
+
+for TDP in "${TDP_NAMES[@]}"; do
+  KEY_KID="$(echo "$TDP" | sed -E 's/(^|_)([a-z])/\U\2/g')FilesystemEncryptionKey"
+  cat >> "$AZ_SCRIPT_3" <<EOF
+import_key "$KEY_KID" \$DATADIR/${TDP}_key.bin
+EOF
+done
+
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+    cat >> "$AZ_SCRIPT_3" <<EOF
+import_key "ModelFilesystemEncryptionKey" \$MODELDIR/model_key.bin
+EOF
+fi
+
+cat >> "$AZ_SCRIPT_3" <<EOF
+import_key "OutputFilesystemEncryptionKey" \$MODELDIR/output_key.bin
+
+## Cleanup
+rm /tmp/importkey-config.json
+rm /tmp/policy-in.json
+EOF
+
+chmod +x "$AZ_SCRIPT_3"
+
+
+# 4-encrypt-data.sh
+
+AZ_SCRIPT_4="$SCENARIO_DIR/deployment/azure/4-encrypt-data.sh"
+cat > "$AZ_SCRIPT_4" <<EOF
+#!/bin/bash
+
+DATADIR=\$REPO_ROOT/scenarios/\$SCENARIO/data
+MODELDIR=\$REPO_ROOT/scenarios/\$SCENARIO/modeller
+
+EOF
+
+for TDP in "${TDP_NAMES[@]}"; do
+  cat >> "$AZ_SCRIPT_4" <<EOF
+./generatefs.sh -d \$DATADIR/$TDP/preprocessed -k \$DATADIR/${TDP}_key.bin -i \$DATADIR/${TDP}.img
+EOF
+done
+
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+    cat >> "$AZ_SCRIPT_4" <<EOF
+
+./generatefs.sh -d \$MODELDIR/models -k \$MODELDIR/model_key.bin -i \$MODELDIR/model.img
+EOF
+fi
+
+cat >> "$AZ_SCRIPT_4" <<EOF
+
+sudo rm -rf \$MODELDIR/output
+mkdir -p \$MODELDIR/output
+./generatefs.sh -d \$MODELDIR/output -k \$MODELDIR/output_key.bin -i \$MODELDIR/output.img
+EOF
+
+chmod +x "$AZ_SCRIPT_4"
+
+
+# 5-upload-encrypted-data.sh
+
+AZ_SCRIPT_5="$SCENARIO_DIR/deployment/azure/5-upload-encrypted-data.sh"
+cat > "$AZ_SCRIPT_5" <<EOF
+#!/bin/bash
+
+DATADIR=\$REPO_ROOT/scenarios/\$SCENARIO/data
+MODELDIR=\$REPO_ROOT/scenarios/\$SCENARIO/modeller
+
+ACCOUNT_KEY=\$(az storage account keys list --account-name \$AZURE_STORAGE_ACCOUNT_NAME --only-show-errors | jq -r .[0].value)
+
+EOF
+
+for TDP in "${TDP_NAMES[@]}"; do
+  UPPER_NAME=$(echo "$TDP" | tr '[:lower:]' '[:upper:]')
+  cat >> "$AZ_SCRIPT_5" <<EOF
+az storage blob upload \\
+  --account-name \$AZURE_STORAGE_ACCOUNT_NAME \\
+  --container \$AZURE_${UPPER_NAME}_CONTAINER_NAME \\
+  --file \$DATADIR/${TDP}.img \\
+  --name data.img \\
+  --type page \\
+  --overwrite \\
+  --account-key \$ACCOUNT_KEY
+
+EOF
+done
+
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+    cat >> "$AZ_SCRIPT_5" <<EOF
+az storage blob upload \\
+  --account-name \$AZURE_STORAGE_ACCOUNT_NAME \\
+  --container \$AZURE_MODEL_CONTAINER_NAME \\
+  --file \$MODELDIR/model.img \\
+  --name data.img \\
+  --type page \\
+  --overwrite \\
+  --account-key \$ACCOUNT_KEY
+
+EOF
+fi
+
+cat >> "$AZ_SCRIPT_5" <<EOF
+az storage blob upload \\
+  --account-name \$AZURE_STORAGE_ACCOUNT_NAME \\
+  --container \$AZURE_OUTPUT_CONTAINER_NAME \\
+  --file \$MODELDIR/output.img \\
+  --name data.img \\
+  --type page \\
+  --overwrite \\
+  --account-key \$ACCOUNT_KEY
+EOF
+
+chmod +x "$AZ_SCRIPT_5"
+
+
+# 6-download-decrypt-model.sh
+
+AZ_SCRIPT_6="$SCENARIO_DIR/deployment/azure/6-download-decrypt-model.sh"
+cat > "$AZ_SCRIPT_6" <<EOF
+#!/bin/bash
+
+MODELDIR=\$REPO_ROOT/scenarios/\$SCENARIO/modeller
+
+sudo rm -rf \$MODELDIR/output
+mkdir -p \$MODELDIR/output
+
+ACCOUNT_KEY=\$(az storage account keys list --account-name \$AZURE_STORAGE_ACCOUNT_NAME --only-show-errors | jq -r .[0].value)
+
+az storage blob download \\
+  --account-name \$AZURE_STORAGE_ACCOUNT_NAME \\
+  --container \$AZURE_OUTPUT_CONTAINER_NAME \\
+  --file \$MODELDIR/output.img \\
+  --name data.img \\
+  --account-key \$ACCOUNT_KEY
+
+encryptedImage=\$MODELDIR/output.img
+keyFilePath=\$MODELDIR/output_key.bin
+
+echo Decrypting \$encryptedImage with key \$keyFilePath
+deviceName=cryptdevice1
+deviceNamePath="/dev/mapper/\$deviceName"
+
+sudo cryptsetup luksOpen "\$encryptedImage" "\$deviceName" \\
+    --key-file "\$keyFilePath" \\ 
+    --integrity-no-journal --persistent
+
+mountPoint=\`mktemp -d\`
+sudo mount -t ext4 "\$deviceNamePath" "\$mountPoint" -o loop
+
+cp -r \$mountPoint/* \$MODELDIR/output/
+
+echo "[!] Closing device..."
+
+sudo umount "\$mountPoint"
+sleep 2
+sudo cryptsetup luksClose "\$deviceName"
+EOF
+
+chmod +x "$AZ_SCRIPT_6"
+
+
+# deploy.sh
+
+AZ_SCRIPT_7="$SCENARIO_DIR/deployment/azure/deploy.sh"
+cat > "$AZ_SCRIPT_7" <<EOF
+#!/bin/bash
+
+set -e 
+
+while getopts ":c:p:" options; do
+    case \$options in 
+        c)contract=\$OPTARG;;
+        p)pipelineConfiguration=\$OPTARG;;
+    esac
+done
+
+if [[ -z "\${contract}" ]]; then
+  echo "No contract specified"
+  exit 1
+fi
+
+if [[ -z "\${pipelineConfiguration}" ]]; then
+  echo "No pipeline configuration specified"
+  exit 1
+fi
+
+if [[ -z "\${AZURE_KEYVAULT_ENDPOINT}" ]]; then
+  echo "Environment variable AZURE_KEYVAULT_ENDPOINT not defined"
+fi
+
+echo Obtaining contract service parameters...
+
+CONTRACT_SERVICE_URL=\${CONTRACT_SERVICE_URL:-"https://localhost:8000"}
+export CONTRACT_SERVICE_PARAMETERS=\$(curl -k -f \$CONTRACT_SERVICE_URL/parameters | base64 --wrap=0)
+
+echo Computing CCE policy...
+envsubst < ../../policy/policy-in-template.json > /tmp/policy-in.json
+export CCE_POLICY=\$(az confcom acipolicygen -i /tmp/policy-in.json --debug-mode)
+export CCE_POLICY_HASH=\$(go run \$TOOLS_HOME/securitypolicydigest/main.go -p \$CCE_POLICY)
+echo "Training container policy hash \$CCE_POLICY_HASH"
+
+export CONTRACTS=\$contract
+export PIPELINE_CONFIGURATION=\`cat \$pipelineConfiguration | base64 --wrap=0\`
+
+echo Generating encrypted file system information...
+end=\`date -u -d "60 minutes" '+%Y-%m-%dT%H:%MZ'\`
+
+EOF
+for TDP in "${TDP_NAMES[@]}"; do
+  UPPER_NAME=$(echo "$TDP" | tr '[:lower:]' '[:upper:]')
+  TOKEN_NAME="${UPPER_NAME}_SAS_TOKEN"
+  cat >> "$AZ_SCRIPT_7" <<EOF
+${TOKEN_NAME}=\$(az storage blob generate-sas --account-name \$AZURE_STORAGE_ACCOUNT_NAME --container-name \$AZURE_${UPPER_NAME}_CONTAINER_NAME --permissions r --name data.img --expiry \$end --only-show-errors) 
+export ${TOKEN_NAME}=\$(echo \$${TOKEN_NAME} | tr -d \")
+export ${TOKEN_NAME}="?\$${TOKEN_NAME}"
+
+EOF
+done
+
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+    cat >> "$AZ_SCRIPT_7" <<EOF
+MODEL_SAS_TOKEN=\$(az storage blob generate-sas --account-name \$AZURE_STORAGE_ACCOUNT_NAME --container-name \$AZURE_MODEL_CONTAINER_NAME --permissions r --name data.img --expiry \$end --only-show-errors) 
+export MODEL_SAS_TOKEN=\$(echo \$MODEL_SAS_TOKEN | tr -d \")
+export MODEL_SAS_TOKEN="?\$MODEL_SAS_TOKEN"
+
+EOF
+fi
+
+cat >> "$AZ_SCRIPT_7" <<EOF
+OUTPUT_SAS_TOKEN=\$(az storage blob generate-sas --account-name \$AZURE_STORAGE_ACCOUNT_NAME --container-name \$AZURE_OUTPUT_CONTAINER_NAME --permissions rw --name data.img --expiry \$end --only-show-errors) 
+export OUTPUT_SAS_TOKEN=\$(echo \$OUTPUT_SAS_TOKEN | tr -d \")
+export OUTPUT_SAS_TOKEN="?\$OUTPUT_SAS_TOKEN"
+
+# Obtain the token based on the AKV resource endpoint subdomain
+if [[ "\$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then
+    export BEARER_TOKEN=\$(az account get-access-token --resource https://vault.azure.net | jq -r .accessToken)
+    echo "Importing keys to AKV key vaults can be only of type RSA-HSM"
+    export AZURE_AKV_KEY_TYPE="RSA-HSM"
+elif [[ "\$AZURE_KEYVAULT_ENDPOINT" == *".managedhsm.azure.net" ]]; then
+    export BEARER_TOKEN=\$(az account get-access-token --resource https://managedhsm.azure.net | jq -r .accessToken)
+    export AZURE_AKV_KEY_TYPE="oct-HSM"
+fi
+
+TMP=\$(jq . encrypted-filesystem-config-template.json)
+EOF
+
+idx=0
+for TDP in "${TDP_NAMES[@]}"; do
+  UPPER_NAME=$(echo "$TDP" | tr '[:lower:]' '[:upper:]')
+  TOKEN_NAME="${UPPER_NAME}_SAS_TOKEN"
+  CONTAINER_NAME="AZURE_${UPPER_NAME}_CONTAINER_NAME"
+  KEY_KID="$(echo "$TDP" | sed -E 's/(^|_)([a-z])/\U\2/g')FilesystemEncryptionKey"
+  cat >> "$AZ_SCRIPT_7" <<EOF
+TMP=\`echo \$TMP | \\
+  jq '.azure_filesystems[$idx].azure_url = "https://" + env.AZURE_STORAGE_ACCOUNT_NAME + ".blob.core.windows.net/" + env.${CONTAINER_NAME} + "/data.img" + env.${TOKEN_NAME}' | \\
+  jq '.azure_filesystems[$idx].mount_point = "/mnt/remote/${TDP}"' | \\
+  jq '.azure_filesystems[$idx].key.kid = "${KEY_KID}"' | \\
+  jq '.azure_filesystems[$idx].key.kty = env.AZURE_AKV_KEY_TYPE' | \\
+  jq '.azure_filesystems[$idx].key.akv.endpoint = env.AZURE_KEYVAULT_ENDPOINT' | \\
+  jq '.azure_filesystems[$idx].key.akv.bearer_token = env.BEARER_TOKEN' | \\
+  jq '.azure_filesystems[$idx].key_derivation.label = "${KEY_KID}"' | \\
+  jq '.azure_filesystems[$idx].key_derivation.salt = "9b53cddbe5b78a0b912a8f05f341bcd4dd839ea85d26a08efaef13e696d999f4"'\`
+
+EOF
+  idx=$((idx+1))
+done
+
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+    cat >> "$AZ_SCRIPT_7" <<EOF
+TMP=\`echo \$TMP | \\
+  jq '.azure_filesystems[$idx].azure_url = "https://" + env.AZURE_STORAGE_ACCOUNT_NAME + ".blob.core.windows.net/" + env.AZURE_MODEL_CONTAINER_NAME + "/data.img" + env.MODEL_SAS_TOKEN' | \\
+  jq '.azure_filesystems[$idx].mount_point = "/mnt/remote/model"' | \\
+  jq '.azure_filesystems[$idx].key.kid = "ModelFilesystemEncryptionKey"' | \\
+  jq '.azure_filesystems[$idx].key.kty = env.AZURE_AKV_KEY_TYPE' | \\
+  jq '.azure_filesystems[$idx].key.akv.endpoint = env.AZURE_KEYVAULT_ENDPOINT' | \\
+  jq '.azure_filesystems[$idx].key.akv.bearer_token = env.BEARER_TOKEN' | \\
+  jq '.azure_filesystems[$idx].key_derivation.label = "ModelFilesystemEncryptionKey"' | \\
+  jq '.azure_filesystems[$idx].key_derivation.salt = "9b53cddbe5b78a0b912a8f05f341bcd4dd839ea85d26a08efaef13e696d999f4"'\`
+
+EOF
+  idx=$((idx+1))
+fi
+
+cat >> "$AZ_SCRIPT_7" <<EOF
+TMP=\`echo \$TMP | \\
+  jq '.azure_filesystems[$idx].azure_url = "https://" + env.AZURE_STORAGE_ACCOUNT_NAME + ".blob.core.windows.net/" + env.AZURE_OUTPUT_CONTAINER_NAME + "/data.img" + env.OUTPUT_SAS_TOKEN' | \\
+  jq '.azure_filesystems[$idx].mount_point = "/mnt/remote/output"' | \\
+  jq '.azure_filesystems[$idx].key.kid = "OutputFilesystemEncryptionKey"' | \\
+  jq '.azure_filesystems[$idx].key.kty = env.AZURE_AKV_KEY_TYPE' | \\
+  jq '.azure_filesystems[$idx].key.akv.endpoint = env.AZURE_KEYVAULT_ENDPOINT' | \\
+  jq '.azure_filesystems[$idx].key.akv.bearer_token = env.BEARER_TOKEN' | \\
+  jq '.azure_filesystems[$idx].key_derivation.label = "OutputFilesystemEncryptionKey"' | \\
+  jq '.azure_filesystems[$idx].key_derivation.salt = "9b53cddbe5b78a0b912a8f05f341bcd4dd839ea85d26a08efaef13e696d999f4"'\`
+
+EOF
+
+cat >> "$AZ_SCRIPT_7" <<'EOF'
+ENCRYPTED_FILESYSTEM_INFORMATION=`echo $TMP | base64 --wrap=0`
+echo $ENCRYPTED_FILESYSTEM_INFORMATION > /tmp/encrypted-filesystem-config.json
+export ENCRYPTED_FILESYSTEM_INFORMATION
+
+echo Generating parameters for ACI deployment...
+TMP=$(jq '.containerRegistry.value = env.CONTAINER_REGISTRY' aci-parameters-template.json)
+TMP=`echo $TMP | jq '.ccePolicy.value = env.CCE_POLICY'`
+TMP=`echo $TMP | jq '.EncfsSideCarArgs.value = env.ENCRYPTED_FILESYSTEM_INFORMATION'`
+TMP=`echo $TMP | jq '.ContractService.value = env.CONTRACT_SERVICE_URL'`
+TMP=`echo $TMP | jq '.ContractServiceParameters.value = env.CONTRACT_SERVICE_PARAMETERS'`
+TMP=`echo $TMP | jq '.Contracts.value = env.CONTRACTS'`
+TMP=`echo $TMP | jq '.PipelineConfiguration.value = env.PIPELINE_CONFIGURATION'`
+echo $TMP > /tmp/aci-parameters.json
+
+echo Deploying training clean room...
+
+echo "Checking if resource group $AZURE_RESOURCE_GROUP exists..."
+RG_EXISTS=$(az group exists --name $AZURE_RESOURCE_GROUP)
+
+if [ "$RG_EXISTS" == "false" ]; then
+  echo "Resource group $AZURE_RESOURCE_GROUP does not exist. Creating it now..."
+  # Create the resource group
+  az group create --name $AZURE_RESOURCE_GROUP --location $AZURE_LOCATION
+else
+  echo "Resource group $AZURE_RESOURCE_GROUP already exists. Skipping creation."
+fi
+
+az deployment group create \
+  --resource-group $AZURE_RESOURCE_GROUP \
+  --template-file arm-template.json \
+  --parameters @/tmp/aci-parameters.json
+
+echo Deployment complete. 
+EOF
+
+chmod +x "$AZ_SCRIPT_7"
+
+
+# generatefs.sh
+
+AZ_SCRIPT_8="$SCENARIO_DIR/deployment/azure/generatefs.sh"
+cat > "$AZ_SCRIPT_8" <<'EOF'
+#!/bin/bash
+
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+while getopts ":d:k:i:" options; do
+    case $options in 
+        d)dataPath=$OPTARG;;
+        k)keyFilePath=$OPTARG;;
+        i)encryptedImage=$OPTARG;;
+    esac
+done
+
+echo Encrypting $dataPath with key $keyFilePath and generating $encryptedImage
+deviceName=cryptdevice1
+deviceNamePath="/dev/mapper/$deviceName"
+
+if [ -f "$keyFilePath" ]; then
+    echo "[!] Encrypting dataset using $keyFilePath"
+else
+    echo "[!] Generating keyfile..."
+    dd if=/dev/random of="$keyFilePath" count=1 bs=32
+    truncate -s 32 "$keyFilePath"
+fi
+
+echo "[!] Creating encrypted image..."
+
+response=`du -s $dataPath`
+read -ra arr <<< "$response"
+size=`echo "x=l($arr)/l(2); scale=0; 2^((x+0.5)/1)*2" | bc -l;`
+
+# cryptsetup requires 16M or more
+
+if (($((size)) < 65536)); then 
+    size="65536"
+fi
+size=$size"K"
+
+echo "Data size: $size"
+
+rm -f "$encryptedImage"
+touch "$encryptedImage"
+truncate --size $size "$encryptedImage"
+
+sudo cryptsetup luksFormat --type luks2 "$encryptedImage" \
+    --key-file "$keyFilePath" -v --batch-mode --sector-size 4096 \
+    --cipher aes-xts-plain64 \
+    --pbkdf pbkdf2 --pbkdf-force-iterations 1000
+
+sudo cryptsetup luksOpen "$encryptedImage" "$deviceName" \
+    --key-file "$keyFilePath" \
+    --integrity-no-journal --persistent
+
+echo "[!] Formatting as ext4..."
+
+sudo mkfs.ext4 "$deviceNamePath"
+
+echo "[!] Mounting..."
+
+mountPoint=`mktemp -d`
+echo "Mounting to $mountPoint"
+sudo mount -t ext4 "$deviceNamePath" "$mountPoint" -o loop
+
+echo "[!] Copying contents to encrypted device..."
+
+# The /* is needed to copy folder contents instead of the folder + contents
+sudo cp -r $dataPath/* "$mountPoint"
+sudo rm -rf "$mountPoint/lost+found"
+ls "$mountPoint"
+
+echo "[!] Closing device..."
+
+sudo umount "$mountPoint"
+sleep 2
+sudo cryptsetup luksClose "$deviceName"
+EOF
+
+chmod +x "$AZ_SCRIPT_8"
+
+
+# aci-parameters-template.json
+
+AZ_SCRIPT_9="$SCENARIO_DIR/deployment/azure/aci-parameters-template.json"
+jq -n \
+'
+{
+  "containerRegistry": {
+    "value": ""
+  },
+  "ccePolicy": {
+    "value": ""
+  },
+  "EncfsSideCarArgs": {
+    "value": ""
+  },
+  "ContractService": {
+    "value": ""
+  },
+  "ContractServiceParameters": {
+    "value": ""
+  },
+  "Contracts": {
+    "value": ""
+  },
+  "PipelineConfiguration": {
+    "value": ""
+  }
+}
+' > "$AZ_SCRIPT_9"
+
+
+# arm-template.json
+
+AZ_SCRIPT_10="$SCENARIO_DIR/deployment/azure/arm-template.json"
+jq -n \
+  --arg scenarioName "depa-training-$SCENARIO_NAME" \
+  '
+  {
+    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+        "name": {
+        "defaultValue": $scenarioName,
+        "type": "string",
+        "metadata": {
+            "description": "Name for the container group"
+        }
+        },
+        "location": {
+        "defaultValue": "northeurope",
+        "type": "string",
+        "metadata": {
+            "description": "Location for all resources."
+        }
+        },
+        "port": {
+        "defaultValue": 8080,
+        "type": "int",
+        "metadata": {
+            "description": "Port to open on the container and the public IP address."
+        }
+        },
+        "containerRegistry": {
+        "defaultValue": "secureString",
+        "type": "string",
+        "metadata": {
+            "description": "The container registry login server."
+        }
+        },
+        "restartPolicy": {
+        "defaultValue": "Never",
+        "allowedValues": [
+            "Always",
+            "Never",
+            "OnFailure"
+        ],
+        "type": "string",
+        "metadata": {
+            "description": "The behavior of Azure runtime if container has stopped."
+        }
+        },
+        "ccePolicy": {
+        "defaultValue": "secureString",
+        "type": "string",
+        "metadata": {
+            "description": "cce policy"
+        }
+        },
+        "EncfsSideCarArgs": {
+        "defaultValue": "secureString",
+        "type": "string",
+        "metadata": {
+            "description": "Remote file system information for storage sidecar."
+        }
+        },
+        "ContractService": {
+        "defaultValue": "secureString",
+        "type": "string",
+        "metadata": {
+            "description": "URL of contract service"
+        }
+        },
+        "Contracts": {
+        "defaultValue": "secureString",
+        "type": "string",
+        "metadata": {
+            "description": "List of contracts"
+        }
+        },
+        "ContractServiceParameters": {
+        "defaultValue": "secureString",
+        "type": "string",
+        "metadata": {
+            "description": "Contract service parameters"
+        }
+        },
+        "PipelineConfiguration": {
+        "defaultValue": "secureString",
+        "type": "string",
+        "metadata": {
+            "description": "Pipeline configuration"
+        }
+        }
+    },
+    "resources": [
+        {
+        "type": "Microsoft.ContainerInstance/containerGroups",
+        "apiVersion": "2023-05-01",
+        "name": "[parameters('name')]",
+        "location": "[parameters('location')]",
+        "properties": {
+            "confidentialComputeProperties": {
+            "ccePolicy": "[parameters('ccePolicy')]"
+            },
+            "containers": [
+            {
+                "name": "depa-training",
+                "properties": {
+                "image": "[concat(parameters('containerRegistry'), '/depa-training:latest')]",
+                "command": [
+                    "/bin/bash",
+                    "run.sh"
+                ],
+                "environmentVariables": [],
+                "volumeMounts": [
+                    {
+                    "name": "remotemounts",
+                    "mountPath": "/mnt/remote"
+                    }
+                ],
+                "resources": {
+                    "requests": {
+                    "cpu": 3,
+                    "memoryInGB": 12
+                    }
+                }
+                }
+            },
+            {
+                "name": "encrypted-storage-sidecar",
+                "properties": {
+                "image": "[concat(parameters('containerRegistry'), '/depa-training-encfs:latest')]",
+                "command": [
+                    "/encfs.sh"
+                ],
+                "environmentVariables": [
+                    {
+                    "name": "EncfsSideCarArgs",
+                    "value": "[parameters('EncfsSideCarArgs')]"
+                    },
+                    {
+                    "name": "ContractService",
+                    "value": "[parameters('ContractService')]"
+                    },
+                    {
+                    "name": "Contracts",
+                    "value": "[parameters('Contracts')]"
+                    },
+                    {
+                    "name": "ContractServiceParameters",
+                    "value": "[parameters('ContractServiceParameters')]"
+                    },
+                    {
+                    "name": "PipelineConfiguration",
+                    "value": "[parameters('PipelineConfiguration')]"
+                    }
+                ],
+                "volumeMounts": [
+                    {
+                    "name": "remotemounts",
+                    "mountPath": "/mnt/remote"
+                    }
+                ],
+                "securityContext": {
+                    "privileged": "true"
+                },
+                "resources": {
+                    "requests": {
+                    "cpu": 0.5,
+                    "memoryInGB": 2
+                    }
+                }
+                }
+            }
+            ],
+            "sku": "Confidential",
+            "osType": "Linux",
+            "restartPolicy": "[parameters('restartPolicy')]",
+            "volumes": [
+            {
+                "name": "remotemounts",
+                "emptydir": {}
+            }
+            ]
+        }
+        }
+    ]
+  }
+  ' > "$AZ_SCRIPT_10"
+
+
+# encrypted-filesystem-config-template.json
+
+AZ_SCRIPT_11="$SCENARIO_DIR/deployment/azure/encrypted-filesystem-config-template.json"
+
+# Initialize the file with empty azure_filesystems array
+jq -n '{"azure_filesystems": []}' > "$AZ_SCRIPT_11"
+
+# Add one filesystem for each TDP
+for TDP in "${TDP_NAMES[@]}"; do
+  jq --argjson new_fs '{
+    "azure_url": "",
+    "azure_url_private": false,
+    "read_write": false,
+    "mount_point": "",
+    "key": {
+      "kid": "",
+      "kty": "",
+      "authority": {
+        "endpoint": "sharedneu.neu.attest.azure.net"
+      },
+      "akv": {
+        "endpoint": "",
+        "api_version": "api-version=7.3-preview",
+        "bearer_token": ""
+      }
+    },
+    "key_derivation": {
+      "salt": "",
+      "label": ""
+    }
+  }' '.azure_filesystems += [$new_fs]' "$AZ_SCRIPT_11" > "$AZ_SCRIPT_11.tmp" && mv "$AZ_SCRIPT_11.tmp" "$AZ_SCRIPT_11"
+done
+
+# Add one filesystem for the output container with read_write true
+jq --argjson new_fs '{
+  "azure_url": "",
+  "azure_url_private": false,
+  "read_write": true,
+  "mount_point": "",
+  "key": {
+    "kid": "",
+    "kty": "",
+    "authority": {
+      "endpoint": "sharedneu.neu.attest.azure.net"
+    },
+    "akv": {
+      "endpoint": "",
+      "api_version": "api-version=7.3-preview",
+      "bearer_token": ""
+    }
+  },
+  "key_derivation": {
+    "salt": "",
+    "label": ""
+  }
+}' '.azure_filesystems += [$new_fs]' "$AZ_SCRIPT_11" > "$AZ_SCRIPT_11.tmp" && mv "$AZ_SCRIPT_11.tmp" "$AZ_SCRIPT_11"
+
+
+######## Create deployment/local ########
+
+# docker-compose-preprocess.yml
+
+PREPROCESS_YML="$SCENARIO_DIR/deployment/local/docker-compose-preprocess.yml"
+
+echo "services:" > "$PREPROCESS_YML"
+for TDP in "${TDP_NAMES[@]}"; do
+  # replace _ with - and make lowercase
+  TDP_SUFFIX=$(echo "$TDP" | tr '_' '-' | tr '[:upper:]' '[:lower:]')
+  UPPER_TDP=$(echo "$TDP" | tr '[:lower:]' '[:upper:]')
+  TDP_INPUT_PATH="\$${UPPER_TDP}_INPUT_PATH"
+  TDP_OUTPUT_PATH="\$${UPPER_TDP}_OUTPUT_PATH"
+  echo "  $TDP:" >> "$PREPROCESS_YML"
+  echo "    image: \${CONTAINER_REGISTRY:+\$CONTAINER_REGISTRY/}preprocess-${TDP_SUFFIX}:latest" >> "$PREPROCESS_YML"
+  echo "    volumes:" >> "$PREPROCESS_YML"
+  echo "      - $TDP_INPUT_PATH:/mnt/input/data" >> "$PREPROCESS_YML"
+  echo "      - $TDP_OUTPUT_PATH:/mnt/output/preprocessed" >> "$PREPROCESS_YML"
+  echo "    command: ["python3", "preprocess_${TDP}.py"]" >> "$PREPROCESS_YML"
+done
+
+# preprocess.sh
+
+PREPROCESS_SH="$SCENARIO_DIR/deployment/local/preprocess.sh"
+
+echo "#!/bin/bash" > "$PREPROCESS_SH"
+echo "export REPO_ROOT=\"\$(git rev-parse --show-toplevel)\"" >> "$PREPROCESS_SH"
+echo "export SCENARIO=\"$SCENARIO_NAME\"" >> "$PREPROCESS_SH"
+echo "export DATA_DIR=\$REPO_ROOT/scenarios/\$SCENARIO/data" >> "$PREPROCESS_SH"
+for TDP in "${TDP_NAMES[@]}"; do
+  UPPER_TDP=$(echo "$TDP" | tr '[:lower:]' '[:upper:]')
+  echo "export ${UPPER_TDP}_INPUT_PATH=\$DATA_DIR/$TDP" >> "$PREPROCESS_SH"
+  echo "export ${UPPER_TDP}_OUTPUT_PATH=\$DATA_DIR/$TDP/preprocessed" >> "$PREPROCESS_SH"
+done
+for TDP in "${TDP_NAMES[@]}"; do
+  UPPER_TDP=$(echo "$TDP" | tr '[:lower:]' '[:upper:]')
+  echo "mkdir -p \$${UPPER_TDP}_OUTPUT_PATH" >> "$PREPROCESS_SH"
+done
+echo "docker compose -f docker-compose-preprocess.yml up --remove-orphans" >> "$PREPROCESS_SH"
+
+chmod +x "$PREPROCESS_SH"
+
+# docker-compose-modelsave.yml & save-model.sh
+
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+  MODEL_YML="$SCENARIO_DIR/deployment/local/docker-compose-modelsave.yml"
+  SCENARIO_PREFIX=$(echo "$SCENARIO_NAME" | tr '_' '-')
+  echo "services:" > "$MODEL_YML"
+  echo "  model_save:" >> "$MODEL_YML"
+  echo "    image: \${CONTAINER_REGISTRY:+\$CONTAINER_REGISTRY/}${SCENARIO_PREFIX}-model-save:latest" >> "$MODEL_YML"
+  echo "    volumes:" >> "$MODEL_YML"
+  echo "      - \$MODEL_OUTPUT_PATH:/mnt/model" >> "$MODEL_YML"
+  echo "      - \$MODEL_CONFIG_PATH:/mnt/config/model_config.json" >> "$MODEL_YML"
+  echo "    command: ["python3", "save_base_model.py"]" >> "$MODEL_YML"
+  chmod +x "$MODEL_YML"
+
+  MODEL_SAVE_SH="$SCENARIO_DIR/deployment/local/save-model.sh"
+  echo "#!/bin/bash" > "$MODEL_SAVE_SH"
+  echo "export REPO_ROOT=\"\$(git rev-parse --show-toplevel)\"" >> "$MODEL_SAVE_SH"
+  echo "export SCENARIO=\"$SCENARIO_NAME\"" >> "$MODEL_SAVE_SH"
+  echo "export MODEL_OUTPUT_PATH=\$REPO_ROOT/scenarios/\$SCENARIO/modeller/models" >> "$MODEL_SAVE_SH"
+  echo "mkdir -p \$MODEL_OUTPUT_PATH" >> "$MODEL_SAVE_SH"
+  echo "export MODEL_CONFIG_PATH=\$REPO_ROOT/scenarios/\$SCENARIO/config/model_config.json" >> "$MODEL_SAVE_SH"
+  echo "docker compose -f docker-compose-modelsave.yml up --remove-orphans" >> "$MODEL_SAVE_SH"
+  chmod +x "$MODEL_SAVE_SH"
+fi
+
+# docker-compose-train.yml
+
+TRAIN_YML="$SCENARIO_DIR/deployment/local/docker-compose-train.yml"
+
+echo "services:" > "$TRAIN_YML"
+echo "  train:" >> "$TRAIN_YML"
+echo "    image: \${CONTAINER_REGISTRY:+\$CONTAINER_REGISTRY/}depa-training:latest" >> "$TRAIN_YML"
+echo "    volumes:" >> "$TRAIN_YML"
+for TDP in "${TDP_NAMES[@]}"; do
+  UPPER_TDP=$(echo "$TDP" | tr '[:lower:]' '[:upper:]')
+  echo "      - \$${UPPER_TDP}_INPUT_PATH:/mnt/remote/${TDP}" >> "$TRAIN_YML"
+done
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+  echo "      - \$MODEL_INPUT_PATH:/mnt/remote/model" >> "$TRAIN_YML"
+fi
+echo "      - \$MODEL_OUTPUT_PATH:/mnt/remote/output" >> "$TRAIN_YML"
+echo "      - \$CONFIGURATION_PATH:/mnt/remote/config" >> "$TRAIN_YML"
+echo "    command: ["/bin/bash", "run.sh"]" >> "$TRAIN_YML"
+
+# train.sh
+
+TRAIN_SH="$SCENARIO_DIR/deployment/local/train.sh"
+echo "#!/bin/bash" > "$TRAIN_SH"
+echo "export REPO_ROOT=\"\$(git rev-parse --show-toplevel)\"" >> "$TRAIN_SH"
+echo "export SCENARIO=\"$SCENARIO_NAME\"" >> "$TRAIN_SH"
+echo "export DATA_DIR=\$REPO_ROOT/scenarios/\$SCENARIO/data" >> "$TRAIN_SH"
+echo "export MODEL_DIR=\$REPO_ROOT/scenarios/\$SCENARIO/modeller" >> "$TRAIN_SH"
+for TDP in "${TDP_NAMES[@]}"; do
+  UPPER_TDP=$(echo "$TDP" | tr '[:lower:]' '[:upper:]')
+  echo "export \$${UPPER_TDP}_INPUT_PATH=\$DATA_DIR/${TDP}/preprocessed" >> "$TRAIN_SH"
+done
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+  echo "export MODEL_INPUT_PATH=\$MODEL_DIR/models" >> "$TRAIN_SH"
+fi
+echo "export MODEL_OUTPUT_PATH=\$MODEL_DIR/output" >> "$TRAIN_SH"
+echo "sudo rm -rf \$MODEL_OUTPUT_PATH" >> "$TRAIN_SH"
+echo "mkdir -p \$MODEL_OUTPUT_PATH" >> "$TRAIN_SH"
+echo "export CONFIGURATION_PATH=\$REPO_ROOT/scenarios/\$SCENARIO/config" >> "$TRAIN_SH"
+echo "\$REPO_ROOT/scenarios/\$SCENARIO/config/consolidate_pipeline.sh" >> "$TRAIN_SH"
+echo "docker compose -f docker-compose-train.yml up --remove-orphans" >> "$TRAIN_SH"
+chmod +x "$TRAIN_SH"
+
+######## Create config/templates ########
+
+# consolidate_pipeline.sh
+
+CONSOLIDATE_PIPELINE_SH="$SCENARIO_DIR/config/consolidate_pipeline.sh"
+cat << EOF > "$CONSOLIDATE_PIPELINE_SH"
+#! /bin/bash
+
+REPO_ROOT="\$(git rev-parse --show-toplevel)"
+SCENARIO="$SCENARIO_NAME"
+
+template_path="\$REPO_ROOT/scenarios/\$SCENARIO/config/templates"
+model_config_path="\$REPO_ROOT/scenarios/\$SCENARIO/config/model_config.json"
+data_config_path="\$REPO_ROOT/scenarios/\$SCENARIO/config/dataset_config.json"
+loss_config_path="\$REPO_ROOT/scenarios/\$SCENARIO/config/loss_config.json"
+train_config_path="\$REPO_ROOT/scenarios/\$SCENARIO/config/train_config.json"
+eval_config_path="\$REPO_ROOT/scenarios/\$SCENARIO/config/eval_config.json"
+join_config_path="\$REPO_ROOT/scenarios/\$SCENARIO/config/join_config.json"
+pipeline_config_path="\$REPO_ROOT/scenarios/\$SCENARIO/config/pipeline_config.json"
+
+# populate "model_config", "data_config", and "loss_config" keys in train config
+train_config=\$(cat \$template_path/train_config_template.json)
+
+# Only merge if the file exists
+if [[ -f "\$model_config_path" ]]; then
+    model_config=\$(cat \$model_config_path)
+    train_config=\$(echo "\$train_config" | jq --argjson model "\$model_config" '.config.model_config = \$model')
+fi
+
+if [[ -f "\$data_config_path" ]]; then
+    data_config=\$(cat \$data_config_path)
+    train_config=\$(echo "\$train_config" | jq --argjson data "\$data_config" '.config.dataset_config = \$data')
+fi
+
+if [[ -f "\$loss_config_path" ]]; then
+    loss_config=\$(cat \$loss_config_path)
+    train_config=\$(echo "\$train_config" | jq --argjson loss "\$loss_config" '.config.loss_config = \$loss')
+fi
+
+if [[ -f "\$eval_config_path" ]]; then
+    eval_config=\$(cat \$eval_config_path)
+    # Get all keys from eval_config and copy them to train_config
+    for key in \$(echo "\$eval_config" | jq -r 'keys[]'); do
+        train_config=\$(echo "\$train_config" | jq --argjson eval "\$eval_config" --arg key "\$key" '.config[\$key] = \$eval[\$key]')
+    done
+fi
+
+# save train_config
+echo "\$train_config" > \$train_config_path
+
+# prepare pipeline config from join_config.json (first dict "config") and train_config.json (second dict "config")
+pipeline_config=\$(cat \$template_path/pipeline_config_template.json)
+
+# Only merge join_config if the file exists
+if [[ -f "\$join_config_path" ]]; then
+    join_config=\$(cat \$join_config_path)
+    pipeline_config=\$(echo "\$pipeline_config" | jq --argjson join "\$join_config" '.pipeline += [\$join]')
+fi
+
+# Always merge train_config as it's required
+pipeline_config=\$(echo "\$pipeline_config" | jq --argjson train "\$train_config" '.pipeline += [\$train]')
+
+# save pipeline_config to pipeline_config.json
+echo "\$pipeline_config" > \$pipeline_config_path
+EOF
+
+chmod +x "$CONSOLIDATE_PIPELINE_SH"
+
+# templates/pipeline_config_template.json
+
+PIPELINE_CONFIG_TEMPLATE="$SCENARIO_DIR/config/templates/pipeline_config_template.json"
+cat << EOF > "$PIPELINE_CONFIG_TEMPLATE"
+{
+  "pipeline": []
+}
+EOF
+TRAIN_CONFIG_TEMPLATE="$SCENARIO_DIR/config/templates/train_config_template.json"
+PRIVACY="false"
+# Check if any dataset has privacy enabled
+if jq -e '.tdps[].datasets[] | select(.privacy == true)' "$INPUT_JSON" > /dev/null 2>&1; then
+  PRIVACY="true"
+fi
+
+# Get minimum epsilon and delta
+if [ "$PRIVACY" = "true" ]; then
+  MIN_EPSILON=$(jq -r '[.tdps[].datasets[] | select(.epsilon != null) | .epsilon] | min' "$INPUT_JSON")
+  MIN_DELTA=$(jq -r '[.tdps[].datasets[] | select(.delta != null) | .delta] | min' "$INPUT_JSON")
+  if [ "$MIN_DELTA" != "null" ]; then
+    MECHANISM="gaussian"
+  else
+    MECHANISM="laplace"
+  fi
+else
+  MIN_EPSILON="null"
+  MIN_DELTA="null"
+  MECHANISM="null"
+fi
+
+# templates/train_config_template.json
+
+cat << EOF > "$TRAIN_CONFIG_TEMPLATE"
+{
+  "name": "$TRAIN_METHOD",
+  "config": {
+    "paths": {
+      "input_dataset_path": "/tmp/",
+      "trained_model_output_path": "/mnt/remote/output"
+    },
+    "is_private": $PRIVACY,
+    "privacy_params": {
+      "epsilon": $MIN_EPSILON,
+      "delta": $MIN_DELTA,
+      "mechanism": "$MECHANISM"
+    }
+  }
+}
+EOF
+
+# If join_type exists in scenario config, create a join_config.json
+if [ -n "$JOIN_TYPE" ]; then
+  JOIN_CONFIG="$SCENARIO_DIR/config/join_config.json"
+  
+  # Initialize the config with empty datasets array
+  jq -n "{\"name\": \"$JOIN_TYPE\", \"config\": {\"datasets\": []}}" > "$JOIN_CONFIG"
+  
+  for TDP in "${TDP_NAMES[@]}"; do
+    # Get datasets for this TDP and iterate over them properly
+    jq -r --arg tdp "$TDP" '.tdps[] | select(.name == $tdp) | .datasets[] | @json' "$INPUT_JSON" | while read -r dataset; do
+      # Extract fields from the dataset JSON
+      dataset_id=$(echo "$dataset" | jq -r '.id')
+      dataset_name=$(echo "$dataset" | jq -r '.name')
+      # Create the dataset object
+      dataset_obj=$(jq -n "{
+        \"id\": \"$dataset_id\",
+        \"provider\": \"$TDP\",
+        \"name\": \"$dataset_name\",
+        \"file\": \"\",
+        \"select_variables\": [],
+        \"mount_path\": \"/mnt/remote/$TDP/\"
+      }")
+      # Append to the datasets array
+      jq --argjson new_dataset "$dataset_obj" '.config.datasets += [$new_dataset]' "$JOIN_CONFIG" > "$JOIN_CONFIG.tmp" && mv "$JOIN_CONFIG.tmp" "$JOIN_CONFIG"
+    done
+  done
+  
+  # Add the joined_dataset to config
+  if [ "$JOIN_TYPE" = "SparkJoin" ]; then
+    joined_dataset_obj=$(jq -n '{
+      "joined_dataset": "/tmp/",
+      "joining_query": "",
+      "joining_key": "",
+      "drop_columns": [],
+      "identifiers": []
+    }')
+    jq --argjson joined_dataset "$joined_dataset_obj" '.config.joined_dataset = $joined_dataset' "$JOIN_CONFIG" > "$JOIN_CONFIG.tmp" && mv "$JOIN_CONFIG.tmp" "$JOIN_CONFIG"
+  fi
+  if [ "$JOIN_TYPE" = "DirectoryJoin" ]; then
+    jq '.config.joined_dataset = "/tmp/"' "$JOIN_CONFIG" > "$JOIN_CONFIG.tmp" && mv "$JOIN_CONFIG.tmp" "$JOIN_CONFIG"
+  fi
+fi
+
+# templates/eval_config_template.json
+
+EVAL_CONFIG="$SCENARIO_DIR/config/eval_config.json"
+cat << EOF > "$EVAL_CONFIG"
+{
+  "task_type": "",
+  "metrics": []
+}
+EOF
+
+# dataset_config.json
+
+DATASET_CONFIG="$SCENARIO_DIR/config/dataset_config.json"
+cat << EOF > "$DATASET_CONFIG"
+{
+  "type": "",
+  "target_variable": "",
+  "missing_strategy": "",
+  "splits": {},
+  "data_type": ""
+}
+EOF
+
+if [ "$MODEL_FORMAT" != "ONNX" ]; then
+  MODEL_CONFIG="$SCENARIO_DIR/config/model_config.json"
+  if [ "$TRAIN_METHOD" = "Train_XGB" ]; then
+    cat << EOF > "$MODEL_CONFIG"
+{
+  "num_boost_round": 0,
+  "booster_params": {
+    "max_depth": 0,
+    "learning_rate": 0.0,
+    "objective": "",
+    "eval_metric": ""
+  }
+}
+EOF
+  fi
+
+  if [ "$TRAIN_METHOD" = "Train_DL" ]; then
+  cat << EOF > "$MODEL_CONFIG"
+{
+  "submodules": "",
+  "layers": "",
+  "input": "",
+  "forward": "",
+  "output": ""
+}
+EOF
+  
+  # loss_config.json
+  LOSS_CONFIG="$SCENARIO_DIR/config/loss_config.json"
+  cat << EOF > "$LOSS_CONFIG"
+{
+  "expression": "",
+  "components": {},
+  "variables": {},
+  "reduction": ""
+}
+EOF
+  fi
+fi
+
+
+######## Create export-variables.sh ########
+
+EXPORT_VARIABLES_SH="$SCENARIO_DIR/export-variables.sh"
+cat << EOF > "$EXPORT_VARIABLES_SH"
+#!/bin/bash
+
+# Azure Naming Rules:
+#
+# Resource Group:
+# - 1-90 characters
+# - Letters, numbers, underscores, parentheses, hyphens, periods allowed
+# - Cannot end with a period (.)
+# - Case-insensitive, unique within subscription
+#
+# Key Vault:
+# - 3-24 characters
+# - Globally unique name
+# - Lowercase letters, numbers, hyphens only
+# - Must start and end with letter or number
+#
+# Storage Account:
+# - 3-24 characters
+# - Globally unique name
+# - Lowercase letters and numbers only
+#
+# Storage Container:
+# - 3-63 characters
+# - Lowercase letters, numbers, hyphens only
+# - Must start and end with a letter or number
+# - No consecutive hyphens
+# - Unique within storage account
+
+EOF
+
+for TDP in "${TDP_NAMES[@]}"; do
+  UPPER_TDP=$(echo "$TDP" | tr '-' '_' | tr '[:lower:]' '[:upper:]')
+  LOWER_TDP=$(echo "$TDP" | sed 's/[_|-]//g' | tr '[:upper:]' '[:lower:]')
+  echo "declare -x AZURE_${UPPER_TDP}_CONTAINER_NAME=${LOWER_TDP}container" >> "$EXPORT_VARIABLES_SH"
+  echo "export AZURE_${UPPER_TDP}_CONTAINER_NAME" >> "$EXPORT_VARIABLES_SH"
+done
+
+if [ "$MODEL_FORMAT" != "ccr_instantiate" ]; then
+  echo "declare -x AZURE_MODEL_CONTAINER_NAME=modelcontainer" >> "$EXPORT_VARIABLES_SH"
+  echo "export AZURE_MODEL_CONTAINER_NAME" >> "$EXPORT_VARIABLES_SH"
+fi
+echo "declare -x AZURE_OUTPUT_CONTAINER_NAME=outputcontainer" >> "$EXPORT_VARIABLES_SH"
+echo "export AZURE_OUTPUT_CONTAINER_NAME" >> "$EXPORT_VARIABLES_SH"
+
+cat >> "$EXPORT_VARIABLES_SH" <<EOF
+
+# For cloud resource creation:
+declare -x SCENARIO="$SCENARIO_NAME"
+declare -x REPO_ROOT="\$(git rev-parse --show-toplevel)"
+declare -x CONTAINER_REGISTRY=ispirt.azurecr.io
+declare -x AZURE_LOCATION=<azure-location>
+declare -x AZURE_SUBSCRIPTION_ID=
+declare -x AZURE_RESOURCE_GROUP=
+declare -x AZURE_KEYVAULT_ENDPOINT=
+declare -x AZURE_STORAGE_ACCOUNT_NAME=
+
+# For key import:
+declare -x CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
+declare -x TOOLS_HOME=\$REPO_ROOT/external/confidential-sidecar-containers/tools
+
+# Export all variables to make them available to other scripts
+export SCENARIO
+export REPO_ROOT
+export CONTAINER_REGISTRY
+export AZURE_LOCATION
+export AZURE_SUBSCRIPTION_ID
+export AZURE_RESOURCE_GROUP
+export AZURE_KEYVAULT_ENDPOINT
+export AZURE_STORAGE_ACCOUNT_NAME
+export CONTRACT_SERVICE_URL
+export TOOLS_HOME
+EOF
+
+chmod +x "$EXPORT_VARIABLES_SH"
+
+# .gitignore
+
+GITIGNORE="$SCENARIO_DIR/.gitignore"
+cat << EOF > "$GITIGNORE"
+data/
+modeller/
+venv/
+
+*.img
+*.bin
+*.csv
+*.parquet
+*.onnx
+*.gz
+*.safetensors
+
+**/__pycache__/
+EOF
\ No newline at end of file
diff --git a/build-your-own-scenario/config/brats.json b/build-your-own-scenario/config/brats.json
new file mode 100644
index 0000000..e4eb677
--- /dev/null
+++ b/build-your-own-scenario/config/brats.json
@@ -0,0 +1,56 @@
+{
+  "scenario_name": "brats-1",
+  "tdps": [
+    {
+      "name": "brats_A",
+      "datasets": [
+        {
+          "name": "BraTS_Brain_MRI_set_A",
+          "id": "19517ba8-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 1.5,
+          "delta": 0.01
+        }
+      ]
+    },
+    {
+      "name": "brats_B",
+      "datasets": [
+        {
+          "name": "BraTS_Brain_MRI_set_B",
+          "id": "216d5cc6-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 1.5,
+          "delta": 0.01
+        }
+      ]
+    },
+    {
+      "name": "brats_C",
+      "datasets": [
+        {
+          "name": "BraTS_Brain_MRI_set_C",
+          "id": "2830a144-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 1.5,
+          "delta": 0.01
+        }
+      ]
+    },
+    {
+      "name": "brats_D",
+      "datasets": [
+        {
+          "name": "BraTS_Brain_MRI_set_D",
+          "id": "2a3b0c4e-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 1.5,
+          "delta": 0.01
+        }
+      ]
+    }
+  ],
+  "training_framework": "Train_DL",
+  "join_type": "DirectoryJoin",
+  "model_format": "Safetensors"
+}
\ No newline at end of file
diff --git a/build-your-own-scenario/config/cifar10.json b/build-your-own-scenario/config/cifar10.json
new file mode 100644
index 0000000..712a8f7
--- /dev/null
+++ b/build-your-own-scenario/config/cifar10.json
@@ -0,0 +1,17 @@
+{
+  "scenario_name": "cifar10-1",
+  "tdps": [
+    {
+      "name": "cifar10",
+      "datasets": [
+        {
+          "name": "cifar10-object-recognition",
+          "id": "19517ba8-bab8-11ed-afa1-0242ac120002",
+          "privacy": false
+        }
+      ]
+    }
+  ],
+  "training_framework": "Train_DL",
+  "model_format": "Safetensors"
+}
\ No newline at end of file
diff --git a/build-your-own-scenario/config/covid.json b/build-your-own-scenario/config/covid.json
new file mode 100644
index 0000000..2027a4f
--- /dev/null
+++ b/build-your-own-scenario/config/covid.json
@@ -0,0 +1,44 @@
+{
+  "scenario_name": "covid-1",
+  "tdps": [
+    {
+      "name": "icmr",
+      "datasets": [
+        {
+          "name": "icmr_test_results",
+          "id": "19517ba8-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 1.5,
+          "delta": 0.01
+        }
+      ]
+    },
+    {
+      "name": "cowin",
+      "datasets": [
+        {
+          "name": "cowin_vaccine_data",
+          "id": "216d5cc6-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 1.5,
+          "delta": 0.01
+        }
+      ]
+    },
+    {
+      "name": "index",
+      "datasets": [
+        {
+          "name": "index_patient_records",
+          "id": "2830a144-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 1.5,
+          "delta": 0.01
+        }
+      ]
+    }
+  ],
+  "training_framework": "Train_DL",
+  "join_type": "SparkJoin",
+  "model_format": "ONNX"
+}
\ No newline at end of file
diff --git a/build-your-own-scenario/config/credit-risk.json b/build-your-own-scenario/config/credit-risk.json
new file mode 100644
index 0000000..0c86aea
--- /dev/null
+++ b/build-your-own-scenario/config/credit-risk.json
@@ -0,0 +1,70 @@
+{
+  "scenario_name": "credit-risk-1",
+  "tdps": [
+    {
+      "name": "bank_a",
+      "datasets": [
+        {
+          "name": "credit_applications",
+          "id": "19517ba8-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 7.5,
+          "delta": 0.00001
+        },
+        {
+          "name": "previous_applications",
+          "id": "216d5cc6-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 7.5,
+          "delta": 0.00001
+        },
+        {
+          "name": "payment_installments",
+          "id": "2830a144-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 9.0,
+          "delta": 0.00001
+        }
+      ]
+    },
+    {
+      "name": "bank_b",
+      "datasets": [
+        {
+          "name": "credit_card_balance",
+          "id": "45647e76-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 5.0,
+          "delta": 0.00001
+        }
+      ]
+    },
+    {
+      "name": "bureau",
+      "datasets": [
+        {
+          "name": "bureau_records",
+          "id": "3187712c-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 4.0,
+          "delta": 0.00001
+        }
+      ]
+    },
+    {
+      "name": "fintech",
+      "datasets": [
+        {
+          "name": "pos_cash_balance",
+          "id": "40e82c74-bab8-11ed-afa1-0242ac120002",
+          "privacy": true,
+          "epsilon": 4.0,
+          "delta": 0.00001
+        }
+      ]
+    }
+  ],
+  "training_framework": "Train_XGB",
+  "join_type": "SparkJoin",
+  "model_format": "ccr_instantiate"
+}
\ No newline at end of file
diff --git a/build-your-own-scenario/config/mnist.json b/build-your-own-scenario/config/mnist.json
new file mode 100644
index 0000000..41b2744
--- /dev/null
+++ b/build-your-own-scenario/config/mnist.json
@@ -0,0 +1,17 @@
+{
+  "scenario_name": "mnist-1",
+  "tdps": [
+    {
+      "name": "mnist",
+      "datasets": [
+        {
+          "name": "mnist-handwritten-digits",
+          "id": "19517ba8-bab8-11ed-afa1-0242ac120002",
+          "privacy": false
+        }
+      ]
+    }
+  ],
+  "training_framework": "Train_DL",
+  "model_format": "ONNX"
+}
\ No newline at end of file
diff --git a/ci/Dockerfile.train b/ci/Dockerfile.train
index dd1111f..757b24c 100644
--- a/ci/Dockerfile.train
+++ b/ci/Dockerfile.train
@@ -13,8 +13,8 @@ RUN python3 get-pip.py
 
 ## Install dependencies
 RUN pip3 install torch torchvision --index-url https://download.pytorch.org/whl/cpu
-RUN pip3 --default-timeout=1000 install pyspark pandas opacus==1.5.3 onnx onnx2pytorch scikit-learn scipy matplotlib 
-RUN pip3 install safetensors h5py pyarrow xgboost
+RUN pip3 --default-timeout=1000 install pyspark pandas opacus==1.5.3 onnx onnx2pytorch onnxscript scikit-learn scipy matplotlib 
+RUN pip3 install safetensors h5py pyarrow xgboost dp-xgboost
 
 # For computer vision tasks
 RUN pip3 install --default-timeout=100 opencv-python pillow monai==1.4.0
diff --git a/gui-demo/README.md b/gui-demo/README.md
new file mode 100644
index 0000000..4049e45
--- /dev/null
+++ b/gui-demo/README.md
@@ -0,0 +1,81 @@
+# Interactive GUI Demo
+
+The Interactive GUI Demo provides a web-based interface to explore and execute DEPA Training scenarios. It automatically discovers all available scenarios in the repository and provides an intuitive interface to configure and run them.
+
+## Features
+
+- **Auto-discovery**: Automatically detects all scenarios in the `scenarios/` directory
+- **Dynamic Configuration**: Parses `export-variables.sh` files to extract environment variables for each scenario
+- **User-friendly Interface**: Simple web UI for configuring and launching training scenarios
+
+## Quick Start
+
+First, follow the steps in the [contract-service](https://github.com/iSPIRT/contract-service?tab=readme-ov-file#contact-ledger-service) repository to sign an electronic contract for the scenario you want to execute, before proceeding with this demo. Ensure to use the same configuration values (eg. for contract service URL, key vaults, cloud storage, etc.) in this demo as during contract signing. Make sure you have an Azure subscription with the necessary permissions to create key vaults and other cloud resources.
+
+Next, from the repository root, launch the demo:
+
+```bash
+./launch-demo.sh
+```
+
+The web interface will be available at:
+- **Local**: http://localhost:5001
+- **Network**: http://\<your-machine-ip\>:5001
+
+To stop the server, press `Ctrl+C` or click the "Shutdown" button in the web interface.
+
+## Requirements
+
+The demo requires:
+- A signed electronic contract for the scenario you want to execute, and the endpoint of the contract service.
+- An Azure subscription with the necessary resources to deploy the scenario. Key Vault admin permissions required to import encryption keys. (Stay tuned for CCR on other cloud platforms.)
+- Flask and Flask-CORS (installed automatically via `requirements.txt`)
+- All prerequisites from the main repository (installed via `install-prerequisites.sh`)
+
+## Steps to Execute a Scenario
+
+This assumes you have already signed the contract and have a cloud subscription ready for the scenario you want to execute. The GUI demo will guide you through the following steps to execute the scenario.
+
+1. Login to your Azure subscription.
+2. Select a scenario from the dropdown menu.
+3. Configure the environment variables for the scenario in the **Settings** tab.
+4. Create cloud resources for the scenario - storage containers and key vault.
+5. Import encryption keys from Key Vault and bind them to a Confidential Computing policy, so it's released only to verified, attested environments.
+6. Encrypt the data and model and upload them to the storage containers.
+7. Modify the training pipeline (as needed) in the **Configurations** tab, in case you want to customize it.
+8. Deploy the Confidential Clean Room (CCR), using the Contract Sequence Number and training pipeline configuration.
+9. Monitor the progress of the training within the CCR in the **Logs** tab. This can take a lot of time depending on the scenario and scale of data and training.
+10. Once training is complete, download the results of the training scenario.
+11. Clean up the deployment and cloud resources.
+
+## How It Works
+
+This demo wraps existing DEPA-Training scenarios in a web interface for easy execution. It is modular and automatically extends to support new scenarios without code changes.
+
+1. **Scenario Discovery**: The demo scans the `scenarios/` directory and identifies all available training scenarios
+2. **Variable Parsing**: For each scenario, it reads the `export-variables.sh` file to extract environment variables
+3. **Configuration UI**: The web interface presents a form with all discovered variables, allowing you to configure them with your own values
+4. **Execution**: When you execute the steps, the GUI picks up all artefacts (data, models, etc.) corresponding to the selected scenario
+5. **Monitoring**: Real-time logs from the CCR are streamed to the web interface so you can monitor progress
+
+## Architecture
+
+The demo consists of:
+- **Backend** (`app.py`): Flask server that handles scenario discovery, variable parsing, and execution
+- **Frontend** (`templates/`, `static/`): Web interface for scenario selection and configuration
+- **Launch Script** (`../launch-demo.sh`): Convenience script to set up and start the demo
+
+## Adding New Scenarios
+
+The demo automatically works with any new scenario you create using the [Build Your Own Scenario](../build-your-own-scenario/README.md) guide. No code changes to the demo are required when adding new scenarios. Stay tuned for DEPA-Training scenarios on other cloud platforms in the future.
+
+## Troubleshooting
+
+1. Azure login issues: In case Azure login through the web interface fails, try logging in manually using the Azure CLI, and then reload the web interface.
+```bash
+az login --use-device-code
+```
+2. Scenario discovery issues: If the scenario dropdown menu is empty, try refreshing the scenarios list.
+3. Deployment issues: If the deployment fails, try deploying manually using the Azure CLI.
+
+If you encounter any other issues, please check the **Logs** tab for error messages. If the problem persists, please open an issue in the [GitHub repository](https://github.com/iSPIRT/depa-training/issues).
\ No newline at end of file
diff --git a/gui-demo/app.py b/gui-demo/app.py
new file mode 100755
index 0000000..ee24e3e
--- /dev/null
+++ b/gui-demo/app.py
@@ -0,0 +1,762 @@
+#!/usr/bin/env python3
+"""
+DEPA Training Demo UI v2 - Modular Flask Backend
+A dynamic web interface that automatically discovers and runs any DEPA training scenario.
+
+Key Features:
+- Auto-discovers scenarios from /scenarios directory
+- Parses export-variables.sh to extract all environment variables
+- Dynamically detects deployment scripts
+- Works with any new scenario without code changes
+"""
+
+import os
+import re
+import json
+import subprocess
+import threading
+import queue
+from pathlib import Path
+from flask import Flask, render_template, jsonify, request, Response
+from flask_cors import CORS
+
+app = Flask(__name__)
+CORS(app)
+
+# Get repository root
+REPO_ROOT = subprocess.run(
+    ["git", "rev-parse", "--show-toplevel"],
+    capture_output=True, text=True, cwd=os.path.dirname(__file__)
+).stdout.strip() or os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+
+SCENARIOS_DIR = Path(REPO_ROOT) / "scenarios"
+
+
+def parse_export_variables(scenario_path: Path) -> dict:
+    """
+    Parse the export-variables.sh file to extract all environment variables.
+    Returns a dict with 'common_vars' and 'scenario_vars' keys.
+    """
+    export_file = scenario_path / "export-variables.sh"
+    
+    result = {
+        "common_vars": {},
+        "scenario_vars": {},
+        "all_vars": {},
+    }
+    
+    if not export_file.exists():
+        return result
+    
+    # Common variable names that apply to all scenarios
+    common_var_names = {
+        "SCENARIO", "REPO_ROOT", "CONTAINER_REGISTRY", "AZURE_LOCATION",
+        "AZURE_SUBSCRIPTION_ID", "AZURE_RESOURCE_GROUP", "AZURE_KEYVAULT_ENDPOINT",
+        "AZURE_STORAGE_ACCOUNT_NAME", "CONTRACT_SERVICE_URL", "TOOLS_HOME"
+    }
+    
+    with open(export_file, 'r') as f:
+        content = f.read()
+    
+    # Match both `declare -x VAR=value` and `export VAR=value` patterns
+    # Also handle values with or without quotes
+    patterns = [
+        r'declare\s+-x\s+(\w+)=(["\']?)([^"\'\n]*)\2',  # declare -x VAR="value" or VAR=value
+        r'export\s+(\w+)=(["\']?)([^"\'\n]*)\2',        # export VAR="value" or VAR=value
+    ]
+    
+    for pattern in patterns:
+        matches = re.findall(pattern, content)
+        for match in matches:
+            var_name = match[0]
+            var_value = match[2] if len(match) > 2 else match[1]
+            
+            # Skip dynamic values like $(git rev-parse...) and $REPO_ROOT references
+            if var_value.startswith('$(') or var_value.startswith('$'):
+                continue
+            
+            result["all_vars"][var_name] = var_value
+            
+            if var_name in common_var_names:
+                result["common_vars"][var_name] = var_value
+            elif var_name.startswith("AZURE_") and "CONTAINER" in var_name:
+                result["scenario_vars"][var_name] = var_value
+    
+    return result
+
+
+def discover_deployment_scripts(scenario_path: Path) -> list:
+    """
+    Discover all deployment scripts in the scenario's azure deployment folder.
+    Returns a sorted list of script info dicts.
+    """
+    azure_dir = scenario_path / "deployment" / "azure"
+    
+    if not azure_dir.exists():
+        return []
+    
+    scripts = []
+    
+    # Define script metadata
+    script_info = {
+        "0-create-acr.sh": {"name": "Create Container Registry", "description": "Create Azure Container Registry (optional)", "optional": True},
+        "1-create-storage-containers.sh": {"name": "Create Storage Containers", "description": "Set up blob storage containers for data and models"},
+        "2-create-akv.sh": {"name": "Create Azure Key Vault", "description": "Create HSM-backed Key Vault for key management and policy enforcement"},
+        "3-import-keys.sh": {"name": "Import Keys", "description": "Import your keys and bind them to a Confidential Computing policy, so it's released only to verified, attested environments."},
+        "4-encrypt-data.sh": {"name": "Encrypt Data", "description": "Encrypt training datasets and models with imported keys"},
+        "5-upload-encrypted-data.sh": {"name": "Upload Encrypted Data", "description": "Upload encrypted data and models to blob storage"},
+        "6-download-decrypt-model.sh": {"name": "Download & Decrypt Model", "description": "Download and decrypt the trained model", "post_deploy": True},
+    }
+    
+    for script_file in sorted(azure_dir.glob("*.sh")):
+        name = script_file.name
+        if name in script_info:
+            scripts.append({
+                "filename": name,
+                "path": str(script_file),
+                **script_info[name]
+            })
+        elif name == "deploy.sh":
+            # Skip deploy.sh as it's handled separately
+            continue
+        elif name not in ["generatefs.sh"]:
+            # Include any other numbered scripts
+            match = re.match(r'^(\d+)-(.+)\.sh$', name)
+            if match:
+                num, rest = match.groups()
+                scripts.append({
+                    "filename": name,
+                    "path": str(script_file),
+                    "name": rest.replace("-", " ").title(),
+                    "description": f"Step {num}: {rest.replace('-', ' ').title()}",
+                })
+    
+    return sorted(scripts, key=lambda x: x["filename"])
+
+
+def get_pipeline_config(scenario_path: Path) -> dict:
+    """Load the pipeline configuration for a scenario."""
+    config_path = scenario_path / "config" / "pipeline_config.json"
+    
+    if not config_path.exists():
+        return None
+    
+    with open(config_path, 'r') as f:
+        return json.load(f)
+
+
+def discover_scenarios() -> list:
+    """
+    Discover all scenarios in the scenarios directory.
+    Returns a list of scenario info dicts.
+    """
+    scenarios = []
+    
+    if not SCENARIOS_DIR.exists():
+        return scenarios
+    
+    for item in sorted(SCENARIOS_DIR.iterdir()):
+        if not item.is_dir() or item.name.startswith("."):
+            continue
+        
+        # Check if it has the required structure
+        has_azure_deployment = (item / "deployment" / "azure").exists()
+        has_export_vars = (item / "export-variables.sh").exists()
+        
+        if not has_azure_deployment:
+            continue
+        
+        # Parse variables
+        vars_info = parse_export_variables(item)
+        
+        # Get pipeline config
+        pipeline_config = get_pipeline_config(item)
+        pipeline_steps = []
+        if pipeline_config:
+            pipeline_steps = [p.get("name", "Unknown") for p in pipeline_config.get("pipeline", [])]
+        
+        # Get deployment scripts
+        deployment_scripts = discover_deployment_scripts(item)
+        
+        scenarios.append({
+            "name": item.name,
+            "path": str(item),
+            "has_azure_deployment": has_azure_deployment,
+            "has_export_vars": has_export_vars,
+            "pipeline_steps": pipeline_steps,
+            "description": f"{len(pipeline_steps)} pipeline step(s): {', '.join(pipeline_steps)}" if pipeline_steps else "Training scenario",
+            "common_vars": vars_info["common_vars"],
+            "scenario_vars": vars_info["scenario_vars"],
+            "deployment_scripts": deployment_scripts,
+        })
+    
+    return scenarios
+
+
+# Global state
+state = {
+    "prerequisites_installed": False,
+    "azure_logged_in": False,
+    "azure_subscription": None,
+    "azure_account_info": None,
+    "current_scenario": None,
+    "scenarios_cache": None,
+    "env_vars": {
+        "REPO_ROOT": REPO_ROOT,
+        "TOOLS_HOME": f"{REPO_ROOT}/external/confidential-sidecar-containers/tools",
+        "AZURE_LOCATION": "northeurope",
+        "AZURE_SUBSCRIPTION_ID": "",
+        "AZURE_RESOURCE_GROUP": "",
+        "AZURE_KEYVAULT_ENDPOINT": "",
+        "AZURE_STORAGE_ACCOUNT_NAME": "",
+        "CONTAINER_REGISTRY": "",
+        "CONTRACT_SERVICE_URL": "",
+    },
+    "scenario_vars": {},
+    "script_status": {},
+    "running_process": None,
+}
+
+
+def get_full_env():
+    """Get full environment variables including scenario-specific ones."""
+    env = os.environ.copy()
+    env.update(state["env_vars"])
+    env.update(state["scenario_vars"])
+    if state["current_scenario"]:
+        env["SCENARIO"] = state["current_scenario"]
+    return env
+
+
+def run_command(cmd, cwd=None, stream=False):
+    """Run a shell command and return output."""
+    env = get_full_env()
+    if cwd is None:
+        cwd = REPO_ROOT
+    
+    if stream:
+        process = subprocess.Popen(
+            cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+            cwd=cwd, env=env, text=True, bufsize=1
+        )
+        return process
+    else:
+        result = subprocess.run(
+            cmd, shell=True, capture_output=True, text=True, cwd=cwd, env=env
+        )
+        return result
+
+
+# ===================== API Routes =====================
+
+@app.route("/")
+def index():
+    return render_template("index.html")
+
+
+@app.route("/api/state")
+def get_state():
+    """Get current application state."""
+    return jsonify({
+        "prerequisites_installed": state["prerequisites_installed"],
+        "azure_logged_in": state["azure_logged_in"],
+        "azure_subscription": state["azure_subscription"],
+        "azure_account_info": state["azure_account_info"],
+        "current_scenario": state["current_scenario"],
+        "env_vars": state["env_vars"],
+        "scenario_vars": state["scenario_vars"],
+        "script_status": state["script_status"],
+    })
+
+
+@app.route("/api/scenarios")
+def get_scenarios():
+    """Get all available scenarios with their configurations."""
+    # Cache scenarios for performance
+    if state["scenarios_cache"] is None:
+        state["scenarios_cache"] = discover_scenarios()
+    return jsonify(state["scenarios_cache"])
+
+
+@app.route("/api/scenarios/refresh")
+def refresh_scenarios():
+    """Force refresh the scenarios cache."""
+    state["scenarios_cache"] = discover_scenarios()
+    return jsonify(state["scenarios_cache"])
+
+
+@app.route("/api/select-scenario", methods=["POST"])
+def select_scenario():
+    """Select a scenario and load its variables."""
+    data = request.json
+    scenario_name = data.get("scenario")
+    
+    # Find the scenario in cache
+    scenarios = state["scenarios_cache"] or discover_scenarios()
+    scenario = next((s for s in scenarios if s["name"] == scenario_name), None)
+    
+    if not scenario:
+        return jsonify({"success": False, "error": f"Scenario not found: {scenario_name}"})
+    
+    state["current_scenario"] = scenario_name
+    
+    # Load scenario-specific variables
+    state["scenario_vars"] = scenario.get("scenario_vars", {}).copy()
+    
+    # Update common vars with scenario defaults (if not already set)
+    common_vars = scenario.get("common_vars", {})
+    for key, value in common_vars.items():
+        if key not in state["env_vars"] or not state["env_vars"][key]:
+            state["env_vars"][key] = value
+    
+    # Reset script status for this scenario
+    state["script_status"] = {}
+    for script in scenario.get("deployment_scripts", []):
+        script_key = script["filename"].replace(".sh", "")
+        state["script_status"][script_key] = "pending"
+    state["script_status"]["deploy"] = "pending"
+    
+    return jsonify({
+        "success": True,
+        "scenario": scenario,
+        "scenario_vars": state["scenario_vars"],
+        "common_vars": common_vars,
+    })
+
+
+@app.route("/api/update-env", methods=["POST"])
+def update_env():
+    """Update environment variables."""
+    data = request.json
+    env_vars = data.get("env_vars", {})
+    scenario_vars = data.get("scenario_vars", {})
+    
+    state["env_vars"].update(env_vars)
+    state["scenario_vars"].update(scenario_vars)
+    
+    return jsonify({"success": True})
+
+
+@app.route("/api/azure/check")
+def check_azure():
+    """Check Azure CLI login status."""
+    result = run_command("az account show --output json")
+    if result.returncode == 0:
+        try:
+            account_info = json.loads(result.stdout)
+            state["azure_logged_in"] = True
+            state["azure_subscription"] = account_info.get("id")
+            state["azure_account_info"] = account_info
+            state["env_vars"]["AZURE_SUBSCRIPTION_ID"] = account_info.get("id", "")
+            return jsonify({
+                "logged_in": True,
+                "account": account_info
+            })
+        except:
+            pass
+    
+    state["azure_logged_in"] = False
+    return jsonify({"logged_in": False})
+
+
+@app.route("/api/azure/login")
+def azure_login():
+    """Initiate Azure login via device code flow."""
+    result = run_command("az login --use-device-code 2>&1")
+    if "To sign in" in result.stdout:
+        return jsonify({
+            "success": True,
+            "message": result.stdout,
+            "requires_device_code": True
+        })
+    return jsonify({
+        "success": result.returncode == 0,
+        "output": result.stdout + result.stderr
+    })
+
+
+@app.route("/api/azure/subscriptions")
+def list_subscriptions():
+    """List Azure subscriptions."""
+    result = run_command("az account list --output json")
+    if result.returncode == 0:
+        try:
+            return jsonify({"success": True, "subscriptions": json.loads(result.stdout)})
+        except:
+            pass
+    return jsonify({"success": False, "error": result.stderr})
+
+
+@app.route("/api/azure/set-subscription", methods=["POST"])
+def set_subscription():
+    """Set the active Azure subscription."""
+    data = request.json
+    subscription_id = data.get("subscription_id")
+    
+    result = run_command(f"az account set --subscription {subscription_id}")
+    if result.returncode == 0:
+        state["azure_subscription"] = subscription_id
+        state["env_vars"]["AZURE_SUBSCRIPTION_ID"] = subscription_id
+        return jsonify({"success": True})
+    return jsonify({"success": False, "error": result.stderr})
+
+
+@app.route("/api/run-script", methods=["POST"])
+def run_script():
+    """Run a deployment script."""
+    data = request.json
+    script_name = data.get("script")
+    
+    scenario = state["current_scenario"]
+    if not scenario:
+        return jsonify({"success": False, "error": "No scenario selected"})
+    
+    script_path = SCENARIOS_DIR / scenario / "deployment" / "azure" / script_name
+    
+    if not script_path.exists():
+        return jsonify({"success": False, "error": f"Script not found: {script_path}"})
+    
+    script_key = script_name.replace(".sh", "")
+    state["script_status"][script_key] = "running"
+    
+    def run_in_background():
+        cwd = script_path.parent
+        cmd = f"bash {script_path}"
+        result = run_command(cmd, cwd=str(cwd))
+        
+        if result.returncode == 0:
+            state["script_status"][script_key] = "completed"
+        else:
+            state["script_status"][script_key] = "failed"
+    
+    thread = threading.Thread(target=run_in_background)
+    thread.start()
+    
+    return jsonify({"success": True, "message": f"Started {script_name}"})
+
+
+@app.route("/api/run-script-stream", methods=["POST"])
+def run_script_stream():
+    """Run a deployment script with streaming output."""
+    data = request.json
+    script_name = data.get("script")
+    
+    scenario = state["current_scenario"]
+    if not scenario:
+        return jsonify({"success": False, "error": "No scenario selected"})
+    
+    script_path = SCENARIOS_DIR / scenario / "deployment" / "azure" / script_name
+    
+    if not script_path.exists():
+        return jsonify({"success": False, "error": f"Script not found: {script_path}"})
+    
+    script_key = script_name.replace(".sh", "")
+    state["script_status"][script_key] = "running"
+    
+    def generate():
+        cwd = script_path.parent
+        cmd = f"bash {script_path}"
+        process = run_command(cmd, cwd=str(cwd), stream=True)
+        state["running_process"] = process
+        
+        try:
+            for line in iter(process.stdout.readline, ''):
+                if line:
+                    yield f"data: {json.dumps({'line': line})}\n\n"
+            
+            process.wait()
+            if process.returncode == 0:
+                state["script_status"][script_key] = "completed"
+                yield f"data: {json.dumps({'status': 'completed'})}\n\n"
+            else:
+                state["script_status"][script_key] = "failed"
+                yield f"data: {json.dumps({'status': 'failed'})}\n\n"
+        finally:
+            state["running_process"] = None
+    
+    return Response(generate(), mimetype='text/event-stream')
+
+
+@app.route("/api/deploy", methods=["POST"])
+def deploy():
+    """Run the deploy.sh script with contract number and pipeline config."""
+    data = request.json
+    contract_seq_no = data.get("contract_seq_no", "1")
+    pipeline_config = data.get("pipeline_config")
+    
+    scenario = state["current_scenario"]
+    if not scenario:
+        return jsonify({"success": False, "error": "No scenario selected"})
+    
+    deploy_path = SCENARIOS_DIR / scenario / "deployment" / "azure" / "deploy.sh"
+    config_path = SCENARIOS_DIR / scenario / "config" / "pipeline_config.json"
+    
+    if not deploy_path.exists():
+        return jsonify({"success": False, "error": "deploy.sh not found"})
+    
+    # If custom pipeline config provided, save it to a temp file
+    if pipeline_config:
+        temp_config_path = Path("/tmp") / f"pipeline_config_{scenario}.json"
+        with open(temp_config_path, "w") as f:
+            json.dump(pipeline_config, f, indent=2)
+        config_arg = str(temp_config_path)
+    else:
+        config_arg = str(config_path)
+    
+    state["script_status"]["deploy"] = "running"
+    
+    def generate():
+        cwd = deploy_path.parent
+        cmd = f"bash {deploy_path} -c {contract_seq_no} -p {config_arg}"
+        env = get_full_env()
+        env["CONTRACT_SEQ_NO"] = str(contract_seq_no)
+        
+        process = subprocess.Popen(
+            cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+            cwd=str(cwd), env=env, text=True, bufsize=1
+        )
+        state["running_process"] = process
+        
+        try:
+            for line in iter(process.stdout.readline, ''):
+                if line:
+                    yield f"data: {json.dumps({'line': line})}\n\n"
+            
+            process.wait()
+            if process.returncode == 0:
+                state["script_status"]["deploy"] = "completed"
+                yield f"data: {json.dumps({'status': 'completed'})}\n\n"
+            else:
+                state["script_status"]["deploy"] = "failed"
+                yield f"data: {json.dumps({'status': 'failed'})}\n\n"
+        finally:
+            state["running_process"] = None
+    
+    return Response(generate(), mimetype='text/event-stream')
+
+
+@app.route("/api/logs")
+def get_logs():
+    """Get container logs."""
+    scenario = state["current_scenario"]
+    if not scenario:
+        return jsonify({"success": False, "error": "No scenario selected"})
+    
+    resource_group = state["env_vars"].get("AZURE_RESOURCE_GROUP", "")
+    container_name = f"depa-training-{scenario}"
+    
+    cmd = f"az container logs --name {container_name} --resource-group {resource_group} --container-name depa-training"
+    result = run_command(cmd)
+    
+    return jsonify({
+        "success": result.returncode == 0,
+        "logs": result.stdout if result.returncode == 0 else result.stderr
+    })
+
+
+@app.route("/api/logs/stream")
+def stream_logs():
+    """Stream container logs."""
+    scenario = state["current_scenario"]
+    if not scenario:
+        return jsonify({"success": False, "error": "No scenario selected"})
+    
+    resource_group = state["env_vars"].get("AZURE_RESOURCE_GROUP", "")
+    container_name = f"depa-training-{scenario}"
+    
+    def generate():
+        cmd = f"az container logs --name {container_name} --resource-group {resource_group} --container-name depa-training --follow"
+        process = run_command(cmd, stream=True)
+        
+        try:
+            for line in iter(process.stdout.readline, ''):
+                if line:
+                    yield f"data: {json.dumps({'line': line})}\n\n"
+        except GeneratorExit:
+            process.terminate()
+    
+    return Response(generate(), mimetype='text/event-stream')
+
+
+@app.route("/api/cleanup", methods=["POST"])
+def cleanup():
+    """Delete the ACI container instance or the entire resource group."""
+    data = request.json or {}
+    cleanup_type = data.get("type", "container")  # Default to container for backward compatibility
+    
+    scenario = state["current_scenario"]
+    if not scenario:
+        return jsonify({"success": False, "error": "No scenario selected"})
+    
+    resource_group = state["env_vars"].get("AZURE_RESOURCE_GROUP", "")
+    if not resource_group:
+        return jsonify({"success": False, "error": "Resource group not configured"})
+    
+    if cleanup_type == "resource_group":
+        # Delete the entire resource group (this will delete all resources including container, key vault, storage, etc.)
+        cmd = f"az group delete --name {resource_group} --yes --no-wait"
+        result = run_command(cmd)
+        
+        # Purge the key vault to free its name (key vaults have a soft delete period)
+        # This needs to happen after deletion, but we'll try it anyway - if it fails, that's ok
+        keyvault_endpoint = state["env_vars"].get("AZURE_KEYVAULT_ENDPOINT", "")
+        if keyvault_endpoint:
+            # Extract vault name from endpoint (e.g., "myvault.vault.azure.net" -> "myvault")
+            vault_name = keyvault_endpoint.split(".")[0]
+            # Try to purge - this may fail if vault doesn't exist or isn't deleted yet, that's ok
+            # We'll run it in a separate thread to not block the response
+            def purge_vault():
+                import time
+                time.sleep(2)  # Wait a bit for deletion to start
+                purge_result = run_command(f"az keyvault purge --name {vault_name}")
+                # Ignore errors - vault might not be deleted yet or might not exist
+            
+            threading.Thread(target=purge_vault, daemon=True).start()
+        
+        return jsonify({
+            "success": result.returncode == 0,
+            "output": result.stdout if result.returncode == 0 else result.stderr,
+            "message": f"Resource group {resource_group} deletion initiated"
+        })
+    else:
+        # Delete only the container instance (original behavior)
+        container_name = f"depa-training-{scenario}"
+        cmd = f"az container delete --name {container_name} --resource-group {resource_group} --yes"
+        result = run_command(cmd)
+        
+        return jsonify({
+            "success": result.returncode == 0,
+            "output": result.stdout if result.returncode == 0 else result.stderr
+        })
+
+
+@app.route("/api/pipeline-config")
+def get_pipeline_config_api():
+    """Get the pipeline configuration for the current scenario."""
+    scenario = state["current_scenario"]
+    if not scenario:
+        return jsonify({"success": False, "error": "No scenario selected"})
+    
+    config_path = SCENARIOS_DIR / scenario / "config" / "pipeline_config.json"
+    
+    if not config_path.exists():
+        return jsonify({"success": False, "error": "Pipeline config not found"})
+    
+    with open(config_path) as f:
+        config = json.load(f)
+    
+    return jsonify({"success": True, "config": config})
+
+
+@app.route("/api/pipeline-config", methods=["POST"])
+def save_pipeline_config():
+    """Save the pipeline configuration."""
+    data = request.json
+    config = data.get("config")
+    
+    scenario = state["current_scenario"]
+    if not scenario:
+        return jsonify({"success": False, "error": "No scenario selected"})
+    
+    temp_config_path = Path("/tmp") / f"pipeline_config_{scenario}.json"
+    with open(temp_config_path, "w") as f:
+        json.dump(config, f, indent=2)
+    
+    return jsonify({"success": True, "path": str(temp_config_path)})
+
+
+@app.route("/api/cancel", methods=["POST"])
+def cancel_running():
+    """Cancel any running process."""
+    if state["running_process"]:
+        try:
+            state["running_process"].terminate()
+            state["running_process"] = None
+            return jsonify({"success": True})
+        except:
+            pass
+    return jsonify({"success": False, "error": "No process running"})
+
+
+@app.route("/api/container-status")
+def container_status():
+    """Get the status of the ACI container."""
+    scenario = state["current_scenario"]
+    if not scenario:
+        return jsonify({"success": False, "error": "No scenario selected"})
+    
+    resource_group = state["env_vars"].get("AZURE_RESOURCE_GROUP", "")
+    container_name = f"depa-training-{scenario}"
+    
+    cmd = f"az container show --name {container_name} --resource-group {resource_group} --query '{{state: instanceView.state, events: containers[0].instanceView.events}}' --output json"
+    result = run_command(cmd)
+    
+    if result.returncode == 0:
+        try:
+            status = json.loads(result.stdout)
+            return jsonify({"success": True, "status": status})
+        except:
+            pass
+    
+    return jsonify({"success": False, "error": result.stderr or "Container not found"})
+
+
+@app.route("/api/shutdown", methods=["POST"])
+def shutdown():
+    """Gracefully shutdown the server."""
+    import os
+    import signal
+    
+    def stop_server():
+        os.kill(os.getpid(), signal.SIGTERM)
+    
+    # Schedule shutdown after response is sent
+    from threading import Timer
+    Timer(0.5, stop_server).start()
+    
+    return jsonify({"success": True, "message": "Server shutting down..."})
+
+
+@app.route("/api/scenario-info/<scenario_name>")
+def get_scenario_info(scenario_name):
+    """Get detailed info about a specific scenario."""
+    scenario_path = SCENARIOS_DIR / scenario_name
+    
+    if not scenario_path.exists():
+        return jsonify({"success": False, "error": "Scenario not found"})
+    
+    vars_info = parse_export_variables(scenario_path)
+    deployment_scripts = discover_deployment_scripts(scenario_path)
+    pipeline_config = get_pipeline_config(scenario_path)
+    
+    # Check for additional config files
+    config_files = []
+    config_dir = scenario_path / "config"
+    if config_dir.exists():
+        for f in config_dir.glob("*.json"):
+            config_files.append(f.name)
+    
+    return jsonify({
+        "success": True,
+        "name": scenario_name,
+        "path": str(scenario_path),
+        "common_vars": vars_info["common_vars"],
+        "scenario_vars": vars_info["scenario_vars"],
+        "all_vars": vars_info["all_vars"],
+        "deployment_scripts": deployment_scripts,
+        "pipeline_config": pipeline_config,
+        "config_files": config_files,
+    })
+
+
+if __name__ == "__main__":
+    import sys
+    port = int(sys.argv[1]) if len(sys.argv) > 1 else 5001
+    # print(f"\n🚀 DEPA Training Demo UI v2 (Modular) starting on http://localhost:{port}\n")
+    # print(f"📁 Scenarios directory: {SCENARIOS_DIR}\n")
+    # print("Discovered scenarios:")
+    # for s in discover_scenarios():
+    #     print(f"  - {s['name']}: {s['description']}")
+    # print()
+    app.run(host="0.0.0.0", port=port, debug=False, threaded=True)
+
diff --git a/gui-demo/requirements.txt b/gui-demo/requirements.txt
new file mode 100644
index 0000000..c595042
--- /dev/null
+++ b/gui-demo/requirements.txt
@@ -0,0 +1,4 @@
+# DEPA Training Demo UI v2 - Modular Edition
+flask>=2.3.0
+flask-cors>=4.0.0
+
diff --git a/gui-demo/static/css/style.css b/gui-demo/static/css/style.css
new file mode 100644
index 0000000..a0e0f17
--- /dev/null
+++ b/gui-demo/static/css/style.css
@@ -0,0 +1,1140 @@
+/*
+ * DEPA Training Demo UI v2 - Modular Edition
+ * A warm, amber-tinted dark theme with soft gradients
+ */
+
+:root {
+    /* Warm Dark Palette */
+    --bg-base: #0d0d0f;
+    --bg-card: #141416;
+    --bg-elevated: #1a1a1d;
+    --bg-input: #0a0a0b;
+    
+    /* Accent - Warm Amber/Gold */
+    --accent: #f0a500;
+    --accent-light: #ffc233;
+    --accent-dark: #b87a00;
+    --accent-glow: rgba(240, 165, 0, 0.15);
+    
+    /* Secondary - Teal */
+    --secondary: #14b8a6;
+    --secondary-light: #2dd4bf;
+    
+    /* Status Colors */
+    --success: #22c55e;
+    --warning: #f59e0b;
+    --danger: #ef4444;
+    --info: #3b82f6;
+    
+    /* Text */
+    --text-primary: #fafafa;
+    --text-secondary: #a1a1aa;
+    --text-muted: #71717a;
+    
+    /* Borders */
+    --border: rgba(255, 255, 255, 0.08);
+    --border-hover: rgba(240, 165, 0, 0.3);
+    
+    /* Shadows */
+    --shadow-sm: 0 1px 2px rgba(0, 0, 0, 0.4);
+    --shadow-md: 0 4px 12px rgba(0, 0, 0, 0.5);
+    --shadow-lg: 0 8px 30px rgba(0, 0, 0, 0.6);
+    --shadow-glow: 0 0 40px var(--accent-glow);
+    
+    /* Spacing */
+    --sp-1: 0.25rem;
+    --sp-2: 0.5rem;
+    --sp-3: 0.75rem;
+    --sp-4: 1rem;
+    --sp-6: 1.5rem;
+    --sp-8: 2rem;
+    
+    /* Radius */
+    --radius-sm: 6px;
+    --radius-md: 10px;
+    --radius-lg: 14px;
+    --radius-xl: 20px;
+    
+    /* Typography */
+    --font-sans: 'Sora', -apple-system, sans-serif;
+    --font-mono: 'Geist Mono', 'JetBrains Mono', monospace;
+}
+
+/* Reset */
+*, *::before, *::after {
+    box-sizing: border-box;
+    margin: 0;
+    padding: 0;
+}
+
+html {
+    font-size: 15px;
+    -webkit-font-smoothing: antialiased;
+}
+
+body {
+    font-family: var(--font-sans);
+    background: var(--bg-base);
+    color: var(--text-primary);
+    line-height: 1.6;
+    min-height: 100vh;
+}
+
+/* Background */
+.app-container {
+    position: relative;
+    min-height: 100vh;
+}
+
+.bg-mesh {
+    position: fixed;
+    inset: 0;
+    background:
+        radial-gradient(ellipse 100% 60% at 0% 0%, rgba(240, 165, 0, 0.06) 0%, transparent 50%),
+        radial-gradient(ellipse 80% 50% at 100% 100%, rgba(20, 184, 166, 0.05) 0%, transparent 50%),
+        var(--bg-base);
+    pointer-events: none;
+    z-index: 0;
+}
+
+/* Header */
+.header {
+    position: sticky;
+    top: 0;
+    z-index: 100;
+    display: flex;
+    align-items: center;
+    gap: var(--sp-8);
+    padding: var(--sp-3) var(--sp-6);
+    background: rgba(13, 13, 15, 0.9);
+    backdrop-filter: blur(16px);
+    border-bottom: 1px solid var(--border);
+}
+
+.logo {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-3);
+}
+
+.logo-icon {
+    width: 36px;
+    height: 36px;
+    color: var(--accent);
+}
+
+.logo-title {
+    font-size: 1.1rem;
+    font-weight: 600;
+    letter-spacing: -0.02em;
+}
+
+.logo-subtitle {
+    display: block;
+    font-size: 0.65rem;
+    color: var(--text-muted);
+    text-transform: uppercase;
+    letter-spacing: 0.08em;
+}
+
+/* Navigation */
+.nav-tabs {
+    display: flex;
+    gap: var(--sp-1);
+    background: var(--bg-card);
+    padding: 3px;
+    border-radius: var(--radius-md);
+    border: 1px solid var(--border);
+}
+
+.nav-tab {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-2);
+    padding: var(--sp-2) var(--sp-4);
+    background: transparent;
+    border: none;
+    color: var(--text-muted);
+    font-family: var(--font-sans);
+    font-size: 0.8rem;
+    font-weight: 500;
+    border-radius: var(--radius-sm);
+    cursor: pointer;
+    transition: all 0.15s ease;
+}
+
+.nav-tab svg {
+    width: 16px;
+    height: 16px;
+}
+
+.nav-tab:hover {
+    color: var(--text-secondary);
+    background: rgba(255, 255, 255, 0.03);
+}
+
+.nav-tab.active {
+    color: var(--accent);
+    background: var(--bg-elevated);
+}
+
+/* Azure Status */
+.header-actions {
+    margin-left: auto;
+    display: flex;
+    align-items: center;
+    gap: var(--sp-3);
+}
+
+.azure-status {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-2);
+    padding: var(--sp-2) var(--sp-3);
+    background: var(--bg-card);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-md);
+    font-size: 0.8rem;
+    color: var(--text-secondary);
+}
+
+.status-dot {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    background: var(--text-muted);
+}
+
+.azure-status.logged-in .status-dot {
+    background: var(--success);
+    box-shadow: 0 0 8px var(--success);
+}
+
+.azure-status.not-logged-in .status-dot {
+    background: var(--warning);
+}
+
+/* Main Content */
+.main-content {
+    position: relative;
+    z-index: 1;
+    max-width: 1300px;
+    margin: 0 auto;
+    padding: var(--sp-6);
+}
+
+/* Pages */
+.page {
+    display: none;
+    flex-direction: column;
+    gap: var(--sp-4);
+}
+
+.page.active {
+    display: flex;
+    animation: fadeSlide 0.25s ease;
+}
+
+@keyframes fadeSlide {
+    from { opacity: 0; transform: translateY(8px); }
+    to { opacity: 1; transform: translateY(0); }
+}
+
+/* Cards */
+.card {
+    background: var(--bg-card);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-lg);
+    overflow: hidden;
+    transition: border-color 0.2s ease;
+}
+
+.card:hover {
+    border-color: var(--border-hover);
+}
+
+.card-header {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-3);
+    padding: var(--sp-4);
+    border-bottom: 1px solid var(--border);
+}
+
+.card-icon {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 40px;
+    height: 40px;
+    border-radius: var(--radius-md);
+    flex-shrink: 0;
+}
+
+.card-icon svg {
+    width: 20px;
+    height: 20px;
+}
+
+.azure-icon { background: linear-gradient(135deg, #0078d4, #00bcf2); color: white; }
+.scenario-icon { background: linear-gradient(135deg, var(--accent-dark), var(--accent)); color: var(--bg-base); }
+.pipeline-icon { background: linear-gradient(135deg, #8b5cf6, #a855f7); color: white; }
+.deploy-icon { background: linear-gradient(135deg, var(--secondary), var(--secondary-light)); color: var(--bg-base); }
+.download-icon { background: linear-gradient(135deg, #3b82f6, #60a5fa); color: white; }
+.cleanup-icon { background: linear-gradient(135deg, #ef4444, #f87171); color: white; }
+.config-icon { background: linear-gradient(135deg, #ec4899, #f472b6); color: white; }
+.logs-icon { background: linear-gradient(135deg, #22c55e, #4ade80); color: var(--bg-base); }
+.settings-icon { background: linear-gradient(135deg, #6366f1, #818cf8); color: white; }
+
+.card-title {
+    font-size: 1rem;
+    font-weight: 600;
+    color: var(--text-primary);
+    flex: 1;
+}
+
+.card-badge {
+    padding: var(--sp-1) var(--sp-2);
+    background: var(--bg-elevated);
+    border-radius: var(--radius-sm);
+    font-size: 0.7rem;
+    color: var(--text-muted);
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+}
+
+.card-actions {
+    display: flex;
+    gap: var(--sp-2);
+}
+
+.card-body {
+    padding: var(--sp-4);
+}
+
+/* Top Row Layout */
+.top-row {
+    display: grid;
+    grid-template-columns: 1fr 1.5fr;
+    gap: var(--sp-4);
+}
+
+/* Azure Card */
+.azure-not-logged-in,
+.azure-logged-in {
+    text-align: center;
+}
+
+.azure-logged-in.hidden,
+.azure-not-logged-in.hidden {
+    display: none;
+}
+
+.hint-text {
+    font-size: 0.85rem;
+    color: var(--text-muted);
+    margin-bottom: var(--sp-4);
+}
+
+.info-compact {
+    text-align: left;
+}
+
+.info-item {
+    display: flex;
+    justify-content: space-between;
+    padding: var(--sp-2) 0;
+    border-bottom: 1px solid var(--border);
+}
+
+.info-item:last-child {
+    border-bottom: none;
+}
+
+.info-label {
+    font-size: 0.8rem;
+    color: var(--text-muted);
+}
+
+.info-value {
+    font-size: 0.85rem;
+    font-weight: 500;
+    color: var(--text-primary);
+}
+
+/* Scenario Selector */
+.scenario-selector {
+    display: flex;
+    flex-direction: column;
+    gap: var(--sp-3);
+}
+
+.scenario-dropdown {
+    width: 100%;
+}
+
+.scenario-info {
+    padding: var(--sp-3);
+    background: var(--bg-elevated);
+    border-radius: var(--radius-sm);
+    min-height: 60px;
+}
+
+.scenario-hint {
+    font-size: 0.8rem;
+    color: var(--text-muted);
+    font-style: italic;
+}
+
+.scenario-details {
+    display: flex;
+    flex-direction: column;
+    gap: var(--sp-2);
+}
+
+.scenario-name-display {
+    font-weight: 600;
+    color: var(--accent);
+    text-transform: capitalize;
+}
+
+.scenario-steps {
+    font-size: 0.8rem;
+    color: var(--text-secondary);
+}
+
+.scenario-vars-count {
+    font-size: 0.75rem;
+    color: var(--text-muted);
+}
+
+/* Pipeline */
+.pipeline-container {
+    display: flex;
+    flex-direction: column;
+    gap: var(--sp-2);
+}
+
+.pipeline-empty {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: var(--sp-3);
+    padding: var(--sp-8);
+    color: var(--text-muted);
+}
+
+.pipeline-empty svg {
+    width: 48px;
+    height: 48px;
+    opacity: 0.3;
+}
+
+.pipeline-step {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-3);
+    padding: var(--sp-3) var(--sp-4);
+    background: var(--bg-elevated);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-md);
+    transition: all 0.15s ease;
+}
+
+.pipeline-step:hover {
+    border-color: var(--border-hover);
+}
+
+.step-number {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 28px;
+    height: 28px;
+    background: var(--bg-base);
+    border: 2px solid var(--border);
+    border-radius: 50%;
+    font-size: 0.75rem;
+    font-weight: 600;
+    color: var(--text-muted);
+    flex-shrink: 0;
+}
+
+.pipeline-step.completed .step-number {
+    background: var(--success);
+    border-color: var(--success);
+    color: white;
+}
+
+.pipeline-step.running .step-number {
+    background: var(--accent);
+    border-color: var(--accent);
+    color: var(--bg-base);
+    animation: pulse 1.5s infinite;
+}
+
+.pipeline-step.failed .step-number {
+    background: var(--danger);
+    border-color: var(--danger);
+    color: white;
+}
+
+@keyframes pulse {
+    0%, 100% { transform: scale(1); }
+    50% { transform: scale(1.1); }
+}
+
+.step-content {
+    flex: 1;
+    min-width: 0;
+}
+
+.step-name {
+    font-size: 0.9rem;
+    font-weight: 500;
+    color: var(--text-primary);
+}
+
+.step-description {
+    font-size: 0.75rem;
+    color: var(--text-muted);
+}
+
+.step-status {
+    padding: var(--sp-1) var(--sp-2);
+    border-radius: 12px;
+    font-size: 0.65rem;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+}
+
+.step-status.pending { background: rgba(113, 113, 122, 0.2); color: var(--text-muted); }
+.step-status.running { background: rgba(240, 165, 0, 0.2); color: var(--accent); }
+.step-status.completed { background: rgba(34, 197, 94, 0.2); color: var(--success); }
+.step-status.failed { background: rgba(239, 68, 68, 0.2); color: var(--danger); }
+
+/* Deploy Form */
+.deploy-form {
+    display: flex;
+    align-items: flex-end;
+    gap: var(--sp-4);
+}
+
+.deploy-form .form-group {
+    flex: 1;
+    max-width: 250px;
+}
+
+/* Bottom Actions */
+.bottom-actions {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: var(--sp-4);
+}
+
+.action-card {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-4);
+    padding: var(--sp-4);
+}
+
+/* Ensure action cards don't clip dropdown menus */
+.card.action-card {
+    overflow: visible;
+}
+
+/* Ensure bottom-actions container doesn't clip dropdowns */
+.bottom-actions {
+    overflow: visible;
+}
+
+.action-card .card-icon {
+    width: 48px;
+    height: 48px;
+}
+
+.action-card .card-icon svg {
+    width: 24px;
+    height: 24px;
+}
+
+.action-content {
+    flex: 1;
+}
+
+.action-content h3 {
+    font-size: 0.95rem;
+    font-weight: 600;
+    margin-bottom: var(--sp-1);
+}
+
+.action-content p {
+    font-size: 0.8rem;
+    color: var(--text-muted);
+}
+
+/* Buttons */
+.btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: var(--sp-2);
+    padding: var(--sp-2) var(--sp-4);
+    font-family: var(--font-sans);
+    font-size: 0.85rem;
+    font-weight: 500;
+    border: none;
+    border-radius: var(--radius-md);
+    cursor: pointer;
+    transition: all 0.15s ease;
+}
+
+.btn svg {
+    width: 16px;
+    height: 16px;
+}
+
+.btn:disabled {
+    opacity: 0.5;
+    cursor: not-allowed;
+}
+
+.btn-primary {
+    background: linear-gradient(135deg, var(--accent-dark), var(--accent));
+    color: var(--bg-base);
+    box-shadow: 0 2px 10px rgba(240, 165, 0, 0.3);
+}
+
+.btn-primary:hover:not(:disabled) {
+    transform: translateY(-1px);
+    box-shadow: 0 4px 15px rgba(240, 165, 0, 0.4);
+}
+
+.btn-outline {
+    background: transparent;
+    color: var(--text-primary);
+    border: 1px solid var(--border);
+}
+
+.btn-outline:hover:not(:disabled) {
+    border-color: var(--accent);
+    background: var(--accent-glow);
+}
+
+.btn-danger {
+    background: linear-gradient(135deg, #dc2626, #ef4444);
+    color: white;
+}
+
+.btn-azure {
+    background: linear-gradient(135deg, #0078d4, #00bcf2);
+    color: white;
+    padding: var(--sp-3) var(--sp-6);
+}
+
+.btn-sm {
+    padding: var(--sp-1) var(--sp-3);
+    font-size: 0.75rem;
+}
+
+.btn-icon {
+    width: 32px;
+    height: 32px;
+    padding: 0;
+    background: var(--bg-elevated);
+    border: 1px solid var(--border);
+    color: var(--text-secondary);
+}
+
+.btn-icon:hover {
+    border-color: var(--accent);
+    color: var(--accent);
+}
+
+.btn-shutdown {
+    margin-left: 0;
+    color: var(--text-muted);
+}
+
+.btn-shutdown:hover {
+    border-color: var(--danger);
+    color: var(--danger);
+    background: rgba(239, 68, 68, 0.1);
+}
+
+.btn-deploy {
+    padding: var(--sp-3) var(--sp-6);
+}
+
+/* Dropdown */
+.dropdown {
+    position: relative;
+    display: inline-block;
+    z-index: 2000;
+}
+
+.dropdown-toggle {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-2);
+    position: relative;
+}
+
+.dropdown-arrow {
+    width: 14px;
+    height: 14px;
+    transition: transform 0.2s ease;
+}
+
+.dropdown.active .dropdown-arrow {
+    transform: rotate(180deg);
+}
+
+.dropdown-menu {
+    position: absolute;
+    bottom: 100%;
+    right: 0;
+    margin-bottom: var(--sp-2);
+    min-width: 220px;
+    background: var(--bg-elevated);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-md);
+    box-shadow: var(--shadow-lg);
+    opacity: 0;
+    visibility: hidden;
+    transform: translateY(4px);
+    transition: opacity 0.15s ease, transform 0.15s ease, visibility 0.15s ease;
+    z-index: 2000;
+    overflow: hidden;
+}
+
+.dropdown.active .dropdown-menu {
+    opacity: 1;
+    visibility: visible;
+    transform: translateY(0);
+}
+
+.dropdown-item {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-3);
+    width: 100%;
+    padding: var(--sp-3) var(--sp-4);
+    background: transparent;
+    border: none;
+    color: var(--text-primary);
+    font-size: 0.85rem;
+    text-align: left;
+    cursor: pointer;
+    transition: background 0.15s ease;
+}
+
+.dropdown-item svg {
+    width: 16px;
+    height: 16px;
+    flex-shrink: 0;
+}
+
+.dropdown-item:hover {
+    background: var(--bg-card);
+}
+
+.dropdown-item-danger {
+    color: var(--danger);
+    border-top: 1px solid var(--border);
+}
+
+.dropdown-item-danger:hover {
+    background: rgba(239, 68, 68, 0.1);
+}
+
+/* Forms */
+.form-group {
+    display: flex;
+    flex-direction: column;
+    gap: var(--sp-1);
+}
+
+.form-label {
+    font-size: 0.8rem;
+    font-weight: 500;
+    color: var(--text-secondary);
+}
+
+.form-input,
+.form-select {
+    padding: var(--sp-2) var(--sp-3);
+    background: var(--bg-input);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-sm);
+    color: var(--text-primary);
+    font-family: var(--font-sans);
+    font-size: 0.85rem;
+    transition: border-color 0.15s ease;
+}
+
+.form-input:focus,
+.form-select:focus {
+    outline: none;
+    border-color: var(--accent);
+}
+
+.form-select {
+    cursor: pointer;
+}
+
+/* Config Editor */
+.full-height {
+    min-height: calc(100vh - 180px);
+    display: flex;
+    flex-direction: column;
+}
+
+.full-height .card-body {
+    flex: 1;
+    display: flex;
+    flex-direction: column;
+}
+
+.editor-filename {
+    font-family: var(--font-mono);
+    font-size: 0.75rem;
+    color: var(--text-muted);
+    padding: var(--sp-1) var(--sp-2);
+    background: var(--bg-elevated);
+    border-radius: var(--radius-sm);
+}
+
+.editor-wrapper,
+.logs-wrapper {
+    flex: 1;
+    background: var(--bg-base);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-md);
+    overflow: hidden;
+}
+
+.config-editor {
+    width: 100%;
+    height: 100%;
+    min-height: 450px;
+    padding: var(--sp-4);
+    background: transparent;
+    border: none;
+    color: var(--text-primary);
+    font-family: var(--font-mono);
+    font-size: 0.8rem;
+    line-height: 1.7;
+    resize: none;
+}
+
+.config-editor:focus {
+    outline: none;
+}
+
+/* Logs */
+.container-status {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-2);
+    padding: var(--sp-1) var(--sp-3);
+    background: var(--bg-elevated);
+    border-radius: var(--radius-sm);
+    font-size: 0.75rem;
+}
+
+.container-status .status-label {
+    color: var(--text-muted);
+}
+
+.container-status .status-value {
+    color: var(--accent);
+    font-weight: 500;
+}
+
+.logs-output {
+    height: 100%;
+    min-height: 450px;
+    padding: var(--sp-4);
+    margin: 0;
+    font-family: var(--font-mono);
+    font-size: 0.75rem;
+    line-height: 1.7;
+    color: var(--text-secondary);
+    white-space: pre-wrap;
+    word-break: break-all;
+    overflow-y: auto;
+}
+
+/* Settings */
+.settings-section {
+    margin-bottom: var(--sp-6);
+}
+
+.settings-section:last-child {
+    margin-bottom: 0;
+}
+
+.settings-title {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-2);
+    font-size: 0.9rem;
+    font-weight: 600;
+    color: var(--text-primary);
+    margin-bottom: var(--sp-4);
+    padding-bottom: var(--sp-2);
+    border-bottom: 1px solid var(--border);
+}
+
+.scenario-tag {
+    padding: var(--sp-1) var(--sp-2);
+    background: var(--accent-glow);
+    border-radius: var(--radius-sm);
+    font-size: 0.65rem;
+    font-weight: 500;
+    color: var(--accent);
+    text-transform: uppercase;
+}
+
+.settings-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(260px, 1fr));
+    gap: var(--sp-3);
+}
+
+.empty-hint {
+    grid-column: 1 / -1;
+    font-size: 0.85rem;
+    color: var(--text-muted);
+    font-style: italic;
+    padding: var(--sp-4);
+    text-align: center;
+}
+
+/* Modal */
+.modal {
+    position: fixed;
+    inset: 0;
+    z-index: 1000;
+    display: none;
+    align-items: center;
+    justify-content: center;
+}
+
+.modal.active {
+    display: flex;
+}
+
+.modal-backdrop {
+    position: absolute;
+    inset: 0;
+    background: rgba(0, 0, 0, 0.8);
+    backdrop-filter: blur(4px);
+}
+
+.modal-content {
+    position: relative;
+    width: 90%;
+    max-width: 850px;
+    max-height: 80vh;
+    background: var(--bg-card);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-lg);
+    display: flex;
+    flex-direction: column;
+    animation: modalIn 0.2s ease;
+}
+
+@keyframes modalIn {
+    from { opacity: 0; transform: scale(0.95); }
+    to { opacity: 1; transform: scale(1); }
+}
+
+.modal-header {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: var(--sp-3) var(--sp-4);
+    border-bottom: 1px solid var(--border);
+}
+
+.modal-title {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-2);
+    font-size: 0.95rem;
+    font-weight: 600;
+}
+
+.modal-title svg {
+    width: 18px;
+    height: 18px;
+    color: var(--accent);
+}
+
+.modal-body {
+    flex: 1;
+    overflow: hidden;
+}
+
+.terminal {
+    height: 350px;
+    background: var(--bg-base);
+}
+
+.terminal-output {
+    height: 100%;
+    padding: var(--sp-4);
+    margin: 0;
+    font-family: var(--font-mono);
+    font-size: 0.75rem;
+    line-height: 1.6;
+    color: var(--secondary-light);
+    white-space: pre-wrap;
+    word-break: break-all;
+    overflow-y: auto;
+}
+
+.modal-footer {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    padding: var(--sp-3) var(--sp-4);
+    border-top: 1px solid var(--border);
+}
+
+.modal-status {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-2);
+    font-size: 0.8rem;
+    color: var(--text-secondary);
+}
+
+.modal-status.success { color: var(--success); }
+.modal-status.error { color: var(--danger); }
+
+/* Spinner */
+.spinner {
+    width: 14px;
+    height: 14px;
+    border: 2px solid var(--border);
+    border-top-color: var(--accent);
+    border-radius: 50%;
+    animation: spin 0.8s linear infinite;
+}
+
+@keyframes spin {
+    to { transform: rotate(360deg); }
+}
+
+/* Toast */
+.toast-container {
+    position: fixed;
+    bottom: var(--sp-6);
+    right: var(--sp-6);
+    z-index: 1100;
+    display: flex;
+    flex-direction: column;
+    gap: var(--sp-2);
+}
+
+.toast {
+    display: flex;
+    align-items: center;
+    gap: var(--sp-3);
+    padding: var(--sp-3) var(--sp-4);
+    background: var(--bg-elevated);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-md);
+    box-shadow: var(--shadow-lg);
+    animation: slideIn 0.25s ease;
+    max-width: 350px;
+}
+
+@keyframes slideIn {
+    from { opacity: 0; transform: translateX(50px); }
+    to { opacity: 1; transform: translateX(0); }
+}
+
+.toast.success { border-color: var(--success); }
+.toast.error { border-color: var(--danger); }
+.toast.info { border-color: var(--info); }
+
+.toast-icon {
+    width: 18px;
+    height: 18px;
+    flex-shrink: 0;
+}
+
+.toast.success .toast-icon { color: var(--success); }
+.toast.error .toast-icon { color: var(--danger); }
+.toast.info .toast-icon { color: var(--accent); }
+
+.toast-message {
+    flex: 1;
+    font-size: 0.85rem;
+}
+
+.toast-close {
+    width: 20px;
+    height: 20px;
+    padding: 0;
+    background: transparent;
+    border: none;
+    color: var(--text-muted);
+    cursor: pointer;
+}
+
+/* Scrollbar */
+::-webkit-scrollbar {
+    width: 6px;
+    height: 6px;
+}
+
+::-webkit-scrollbar-track {
+    background: var(--bg-base);
+}
+
+::-webkit-scrollbar-thumb {
+    background: var(--border);
+    border-radius: 3px;
+}
+
+::-webkit-scrollbar-thumb:hover {
+    background: var(--text-muted);
+}
+
+/* Utilities */
+.hidden { display: none !important; }
+
+/* Responsive */
+@media (max-width: 900px) {
+    .header {
+        flex-wrap: wrap;
+        gap: var(--sp-4);
+    }
+    
+    .nav-tabs {
+        order: 3;
+        width: 100%;
+    }
+    
+    .top-row,
+    .bottom-actions {
+        grid-template-columns: 1fr;
+    }
+    
+    .deploy-form {
+        flex-direction: column;
+        align-items: stretch;
+    }
+    
+    .deploy-form .form-group {
+        max-width: none;
+    }
+}
+
diff --git a/gui-demo/static/js/app.js b/gui-demo/static/js/app.js
new file mode 100644
index 0000000..92751fe
--- /dev/null
+++ b/gui-demo/static/js/app.js
@@ -0,0 +1,739 @@
+/**
+ * DEPA Training Demo UI v2 - Modular Frontend
+ * Dynamically discovers and manages any training scenario
+ */
+
+class DepaTrainingApp {
+    constructor() {
+        this.state = {
+            scenarios: [],
+            currentScenario: null,
+            currentScenarioData: null,
+            azureLoggedIn: false,
+            pipelineConfig: null,
+            eventSource: null,
+        };
+        
+        this.init();
+    }
+
+    async init() {
+        this.bindEvents();
+        await this.loadScenarios();
+        await this.checkAzureStatus();
+        this.renderCommonSettings();
+    }
+
+    bindEvents() {
+        // Navigation
+        document.querySelectorAll('.nav-tab').forEach(tab => {
+            tab.addEventListener('click', () => this.switchPage(tab.dataset.page));
+        });
+
+        // Azure
+        document.getElementById('btnAzureLogin').addEventListener('click', () => this.azureLogin());
+
+        // Scenarios
+        document.getElementById('scenarioSelect').addEventListener('change', (e) => {
+            if (e.target.value) this.selectScenario(e.target.value);
+        });
+        document.getElementById('btnRefreshScenarios').addEventListener('click', () => this.refreshScenarios());
+
+        // Deploy
+        document.getElementById('btnDeploy').addEventListener('click', () => this.deploy());
+        document.getElementById('btnDownload').addEventListener('click', () => this.downloadModel());
+        
+        // Cleanup dropdown
+        const btnCleanup = document.getElementById('btnCleanup');
+        const cleanupDropdown = document.getElementById('cleanupDropdown');
+        btnCleanup.addEventListener('click', (e) => {
+            e.stopPropagation();
+            btnCleanup.closest('.dropdown').classList.toggle('active');
+        });
+        document.getElementById('btnCleanupContainer').addEventListener('click', () => this.cleanupContainer());
+        document.getElementById('btnCleanupResourceGroup').addEventListener('click', () => this.cleanupResourceGroup());
+        
+        // Close dropdown when clicking outside
+        document.addEventListener('click', (e) => {
+            if (!e.target.closest('.dropdown')) {
+                document.querySelectorAll('.dropdown').forEach(d => d.classList.remove('active'));
+            }
+        });
+
+        // Config
+        document.getElementById('btnReloadConfig').addEventListener('click', () => this.loadPipelineConfig());
+        document.getElementById('btnSaveConfig').addEventListener('click', () => this.savePipelineConfig());
+
+        // Logs
+        document.getElementById('btnRefreshLogs').addEventListener('click', () => this.refreshLogs());
+
+        // Settings
+        document.getElementById('btnSaveSettings').addEventListener('click', () => this.saveSettings());
+
+        // Modal
+        document.getElementById('btnCloseModal').addEventListener('click', () => this.closeModal());
+        document.getElementById('btnCancelScript').addEventListener('click', () => this.cancelScript());
+        document.querySelector('.modal-backdrop').addEventListener('click', () => this.closeModal());
+
+        // Shutdown
+        document.getElementById('btnShutdown').addEventListener('click', () => this.shutdown());
+    }
+
+    async shutdown() {
+        if (!confirm('Shutdown the Demo UI server?')) return;
+        
+        this.toast('Shutting down server...', 'info');
+        try {
+            await fetch('/api/shutdown', { method: 'POST' });
+        } catch (e) {
+            // Expected - server will close connection
+        }
+        document.body.innerHTML = '<div style="display:flex;align-items:center;justify-content:center;height:100vh;background:#0d0d0f;color:#fafafa;font-family:system-ui;"><div style="text-align:center;"><h1 style="color:#f0a500;">Server Stopped</h1><p style="color:#a1a1aa;">You can close this tab now.</p></div></div>';
+    }
+
+    // ============= Navigation =============
+
+    switchPage(page) {
+        document.querySelectorAll('.nav-tab').forEach(t => t.classList.toggle('active', t.dataset.page === page));
+        document.querySelectorAll('.page').forEach(p => p.classList.toggle('active', p.id === `page-${page}`));
+
+        if (page === 'config') this.loadPipelineConfig();
+        if (page === 'logs') { this.refreshLogs(); this.checkContainerStatus(); }
+        if (page === 'settings') this.loadSettings();
+    }
+
+    // ============= Scenarios =============
+
+    async loadScenarios() {
+        try {
+            const res = await fetch('/api/scenarios');
+            this.state.scenarios = await res.json();
+            this.renderScenarioDropdown();
+        } catch (e) {
+            console.error('Failed to load scenarios:', e);
+            this.toast('Failed to load scenarios', 'error');
+        }
+    }
+
+    async refreshScenarios() {
+        try {
+            const res = await fetch('/api/scenarios/refresh');
+            this.state.scenarios = await res.json();
+            this.renderScenarioDropdown();
+            this.toast('Scenarios refreshed', 'success');
+        } catch (e) {
+            this.toast('Failed to refresh scenarios', 'error');
+        }
+    }
+
+    renderScenarioDropdown() {
+        const select = document.getElementById('scenarioSelect');
+        const current = select.value;
+        
+        select.innerHTML = '<option value="">Select a scenario...</option>' +
+            this.state.scenarios.map(s => 
+                `<option value="${s.name}" ${s.name === current ? 'selected' : ''}>${this.formatName(s.name)}</option>`
+            ).join('');
+    }
+
+    async selectScenario(scenarioName) {
+        try {
+            const res = await fetch('/api/select-scenario', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ scenario: scenarioName })
+            });
+            const data = await res.json();
+            
+            if (data.success) {
+                this.state.currentScenario = scenarioName;
+                this.state.currentScenarioData = data.scenario;
+                // Clear the cached pipeline config when switching scenarios!
+                this.state.pipelineConfig = null;
+                this.renderScenarioInfo(data.scenario);
+                this.renderPipeline(data.scenario);
+                this.renderScenarioSettings(data.scenario_vars);
+                this.toast(`Selected: ${this.formatName(scenarioName)}`, 'success');
+            }
+        } catch (e) {
+            console.error('Failed to select scenario:', e);
+            this.toast('Failed to select scenario', 'error');
+        }
+    }
+
+    renderScenarioInfo(scenario) {
+        const info = document.getElementById('scenarioInfo');
+        const badge = document.getElementById('pipelineScenarioBadge');
+        const settingsTag = document.getElementById('settingsScenarioTag');
+        
+        badge.textContent = this.formatName(scenario.name);
+        settingsTag.textContent = this.formatName(scenario.name);
+        
+        info.innerHTML = `
+            <div class="scenario-details">
+                <span class="scenario-name-display">${this.formatName(scenario.name)}</span>
+                <span class="scenario-steps">${scenario.description || 'Training scenario'}</span>
+                <span class="scenario-vars-count">${Object.keys(scenario.scenario_vars || {}).length} scenario variables</span>
+            </div>
+        `;
+    }
+
+    renderPipeline(scenario) {
+        const container = document.getElementById('pipelineContainer');
+        const scripts = scenario.deployment_scripts || [];
+        
+        if (scripts.length === 0) {
+            container.innerHTML = `
+                <div class="pipeline-empty">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5">
+                        <path d="M21 16V8a2 2 0 00-1-1.73l-7-4a2 2 0 00-2 0l-7 4A2 2 0 003 8v8a2 2 0 001 1.73l7 4a2 2 0 002 0l7-4A2 2 0 0021 16z"/>
+                    </svg>
+                    <p>No deployment scripts found for this scenario</p>
+                </div>
+            `;
+            return;
+        }
+        
+        // Filter out post-deploy scripts and optional scripts for main pipeline
+        const mainScripts = scripts.filter(s => !s.post_deploy && !s.optional);
+        
+        container.innerHTML = mainScripts.map((script, idx) => {
+            const key = script.filename.replace('.sh', '');
+            return `
+                <div class="pipeline-step" data-script="${script.filename}" data-key="${key}">
+                    <div class="step-number">${idx + 1}</div>
+                    <div class="step-content">
+                        <div class="step-name">${script.name}</div>
+                        <div class="step-description">${script.description}</div>
+                    </div>
+                    <span class="step-status pending">Pending</span>
+                    <button class="btn btn-outline btn-sm step-run-btn">Run</button>
+                </div>
+            `;
+        }).join('');
+        
+        // Bind run buttons
+        container.querySelectorAll('.step-run-btn').forEach(btn => {
+            btn.addEventListener('click', (e) => {
+                const step = e.target.closest('.pipeline-step');
+                this.runScript(step.dataset.script, step.dataset.key);
+            });
+        });
+    }
+
+    // ============= Azure =============
+
+    async checkAzureStatus() {
+        try {
+            const res = await fetch('/api/azure/check');
+            const data = await res.json();
+            
+            const statusEl = document.getElementById('azureStatus');
+            const notLoggedIn = document.getElementById('azureNotLoggedIn');
+            const loggedIn = document.getElementById('azureLoggedIn');
+            
+            if (data.logged_in) {
+                this.state.azureLoggedIn = true;
+                statusEl.classList.add('logged-in');
+                statusEl.classList.remove('not-logged-in');
+                statusEl.querySelector('.status-text').textContent = 'Connected';
+                
+                notLoggedIn.classList.add('hidden');
+                loggedIn.classList.remove('hidden');
+                
+                document.getElementById('subscriptionName').textContent = data.account.name || '-';
+                document.getElementById('userName').textContent = data.account.user?.name || '-';
+            } else {
+                statusEl.classList.remove('logged-in');
+                statusEl.classList.add('not-logged-in');
+                statusEl.querySelector('.status-text').textContent = 'Not connected';
+                
+                notLoggedIn.classList.remove('hidden');
+                loggedIn.classList.add('hidden');
+            }
+        } catch (e) {
+            console.error('Azure check failed:', e);
+        }
+    }
+
+    async azureLogin() {
+        this.toast('Starting Azure login...', 'info');
+        try {
+            const res = await fetch('/api/azure/login');
+            const data = await res.json();
+            
+            if (data.requires_device_code) {
+                this.toast('Complete login in browser with the device code', 'info');
+                this.pollAzureLogin();
+            } else if (data.success) {
+                await this.checkAzureStatus();
+                this.toast('Logged in successfully', 'success');
+            }
+        } catch (e) {
+            this.toast('Login failed', 'error');
+        }
+    }
+
+    async pollAzureLogin() {
+        let attempts = 0;
+        const poll = async () => {
+            if (++attempts > 60) return this.toast('Login timeout', 'error');
+            const res = await fetch('/api/azure/check');
+            const data = await res.json();
+            if (data.logged_in) {
+                await this.checkAzureStatus();
+                this.toast('Logged in successfully', 'success');
+            } else {
+                setTimeout(poll, 2000);
+            }
+        };
+        setTimeout(poll, 5000);
+    }
+
+    // ============= Scripts =============
+
+    async runScript(scriptName, scriptKey) {
+        if (!this.state.currentScenario) {
+            return this.toast('Select a scenario first', 'error');
+        }
+        if (!this.state.azureLoggedIn) {
+            return this.toast('Login to Azure first', 'error');
+        }
+
+        this.openModal(scriptName);
+        this.updateStepStatus(scriptKey, 'running');
+        
+        const terminal = document.getElementById('terminalOutput');
+        terminal.textContent = `$ ./${scriptName}\n\n`;
+
+        try {
+            const res = await fetch('/api/run-script-stream', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ script: scriptName })
+            });
+
+            const reader = res.body.getReader();
+            const decoder = new TextDecoder();
+
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done) break;
+
+                for (const line of decoder.decode(value).split('\n')) {
+                    if (line.startsWith('data: ')) {
+                        try {
+                            const data = JSON.parse(line.slice(6));
+                            if (data.line) {
+                                terminal.textContent += data.line;
+                                terminal.scrollTop = terminal.scrollHeight;
+                            }
+                            if (data.status) {
+                                this.updateStepStatus(scriptKey, data.status);
+                                this.updateModalStatus(data.status);
+                            }
+                        } catch {}
+                    }
+                }
+            }
+        } catch (e) {
+            this.updateStepStatus(scriptKey, 'failed');
+            this.updateModalStatus('failed');
+        }
+    }
+
+    updateStepStatus(key, status) {
+        const step = document.querySelector(`.pipeline-step[data-key="${key}"]`);
+        if (!step) return;
+        
+        step.classList.remove('pending', 'running', 'completed', 'failed');
+        step.classList.add(status);
+        
+        const badge = step.querySelector('.step-status');
+        badge.className = `step-status ${status}`;
+        badge.textContent = status.charAt(0).toUpperCase() + status.slice(1);
+    }
+
+    // ============= Deploy =============
+
+    async deploy() {
+        if (!this.state.currentScenario) {
+            return this.toast('Select a scenario first', 'error');
+        }
+        if (!this.state.azureLoggedIn) {
+            return this.toast('Login to Azure first', 'error');
+        }
+
+        const contractSeqNo = document.getElementById('contractSeqNo').value;
+        this.openModal('deploy.sh');
+        
+        const terminal = document.getElementById('terminalOutput');
+        terminal.textContent = `$ ./deploy.sh -c ${contractSeqNo} -p ../../config/pipeline_config.json\n\n`;
+
+        try {
+            const res = await fetch('/api/deploy', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ 
+                    contract_seq_no: contractSeqNo,
+                    pipeline_config: this.state.pipelineConfig
+                })
+            });
+
+            const reader = res.body.getReader();
+            const decoder = new TextDecoder();
+
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done) break;
+
+                for (const line of decoder.decode(value).split('\n')) {
+                    if (line.startsWith('data: ')) {
+                        try {
+                            const data = JSON.parse(line.slice(6));
+                            if (data.line) {
+                                terminal.textContent += data.line;
+                                terminal.scrollTop = terminal.scrollHeight;
+                            }
+                            if (data.status) {
+                                this.updateModalStatus(data.status);
+                            }
+                        } catch {}
+                    }
+                }
+            }
+        } catch (e) {
+            this.updateModalStatus('failed');
+        }
+    }
+
+    async downloadModel() {
+        if (!this.state.currentScenarioData) {
+            return this.toast('Select a scenario first', 'error');
+        }
+        
+        // Find download script
+        const scripts = this.state.currentScenarioData.deployment_scripts || [];
+        const downloadScript = scripts.find(s => s.post_deploy || s.filename.includes('download'));
+        
+        if (downloadScript) {
+            this.runScript(downloadScript.filename, downloadScript.filename.replace('.sh', ''));
+        } else {
+            this.toast('Download script not found', 'error');
+        }
+    }
+
+    async cleanupContainer() {
+        if (!this.state.currentScenario) {
+            return this.toast('Select a scenario first', 'error');
+        }
+        if (!confirm('Delete the container instance?')) return;
+
+        // Close dropdown
+        document.querySelectorAll('.dropdown').forEach(d => d.classList.remove('active'));
+
+        this.toast('Deleting container...', 'info');
+        try {
+            const res = await fetch('/api/cleanup', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ type: 'container' }) });
+            const data = await res.json();
+            this.toast(data.success ? 'Container deleted' : 'Cleanup failed', data.success ? 'success' : 'error');
+        } catch {
+            this.toast('Cleanup failed', 'error');
+        }
+    }
+
+    async cleanupResourceGroup() {
+        if (!this.state.currentScenario) {
+            return this.toast('Select a scenario first', 'error');
+        }
+        const resourceGroup = this.state.currentScenarioData?.common_vars?.AZURE_RESOURCE_GROUP || 'the resource group';
+        if (!confirm(`⚠️ WARNING: This will delete the entire resource group "${resourceGroup}" including:\n\n- Container instance\n- Key Vault (will be purged to free the name)\n- Storage account\n- All other resources in the group\n\nThis action cannot be undone. Continue?`)) return;
+
+        // Close dropdown
+        document.querySelectorAll('.dropdown').forEach(d => d.classList.remove('active'));
+
+        this.toast('Deleting resource group...', 'info');
+        try {
+            const res = await fetch('/api/cleanup', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ type: 'resource_group' }) });
+            const data = await res.json();
+            this.toast(data.success ? 'Resource group deleted' : 'Cleanup failed', data.success ? 'success' : 'error');
+        } catch {
+            this.toast('Cleanup failed', 'error');
+        }
+    }
+
+    // ============= Config =============
+
+    async loadPipelineConfig() {
+        if (!this.state.currentScenario) {
+            document.getElementById('configEditor').value = '// Select a scenario to load configuration';
+            return;
+        }
+
+        try {
+            const res = await fetch('/api/pipeline-config');
+            const data = await res.json();
+            
+            if (data.success) {
+                this.state.pipelineConfig = data.config;
+                document.getElementById('configEditor').value = JSON.stringify(data.config, null, 2);
+                document.getElementById('configFilename').textContent = `pipeline_config.json (${this.state.currentScenario})`;
+            } else {
+                document.getElementById('configEditor').value = `// Error: ${data.error}`;
+            }
+        } catch {
+            document.getElementById('configEditor').value = '// Failed to load configuration';
+        }
+    }
+
+    async savePipelineConfig() {
+        const editor = document.getElementById('configEditor');
+        try {
+            const config = JSON.parse(editor.value);
+            this.state.pipelineConfig = config;
+            
+            await fetch('/api/pipeline-config', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ config })
+            });
+            
+            this.toast('Configuration saved', 'success');
+        } catch {
+            this.toast('Invalid JSON format', 'error');
+        }
+    }
+
+    // ============= Logs =============
+
+    async refreshLogs() {
+        if (!this.state.currentScenario) {
+            document.getElementById('logsOutput').textContent = 'Select a scenario first...';
+            return;
+        }
+
+        document.getElementById('logsOutput').textContent = 'Loading logs...';
+        
+        try {
+            const res = await fetch('/api/logs');
+            const data = await res.json();
+            document.getElementById('logsOutput').textContent = data.logs || 'No logs available';
+        } catch {
+            document.getElementById('logsOutput').textContent = 'Failed to fetch logs';
+        }
+    }
+
+    streamLogs() {
+        if (!this.state.currentScenario) {
+            return this.toast('Select a scenario first', 'error');
+        }
+
+        const output = document.getElementById('logsOutput');
+        const btn = document.getElementById('btnStreamLogs');
+        
+        if (this.state.eventSource) {
+            this.state.eventSource.close();
+            this.state.eventSource = null;
+            btn.innerHTML = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polygon points="5,3 19,12 5,21"/></svg>Stream';
+            return;
+        }
+
+        output.textContent = 'Streaming logs...\n';
+        btn.innerHTML = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="6" y="4" width="4" height="16"/><rect x="14" y="4" width="4" height="16"/></svg>Stop';
+
+        this.state.eventSource = new EventSource('/api/logs/stream');
+        this.state.eventSource.onmessage = (e) => {
+            try {
+                const data = JSON.parse(e.data);
+                if (data.line) {
+                    output.textContent += data.line;
+                    output.scrollTop = output.scrollHeight;
+                }
+            } catch {}
+        };
+        this.state.eventSource.onerror = () => {
+            this.state.eventSource.close();
+            this.state.eventSource = null;
+            btn.innerHTML = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polygon points="5,3 19,12 5,21"/></svg>Stream';
+        };
+    }
+
+    async checkContainerStatus() {
+        if (!this.state.currentScenario) return;
+        
+        try {
+            const res = await fetch('/api/container-status');
+            const data = await res.json();
+            document.getElementById('containerStatusValue').textContent = data.success ? (data.status?.state || 'Unknown') : 'Not found';
+        } catch {
+            document.getElementById('containerStatusValue').textContent = 'Error';
+        }
+    }
+
+    // ============= Settings =============
+
+    renderCommonSettings() {
+        const commonVars = [
+            { key: 'AZURE_LOCATION', label: 'Azure Location', type: 'select', options: ['northeurope', 'westeurope', 'eastus', 'westus', 'centralindia', 'southeastasia'] },
+            { key: 'AZURE_RESOURCE_GROUP', label: 'Resource Group', placeholder: 'depa-train-ccr-demo' },
+            { key: 'AZURE_KEYVAULT_ENDPOINT', label: 'Key Vault Endpoint', placeholder: 'your-vault.vault.azure.net' },
+            { key: 'AZURE_STORAGE_ACCOUNT_NAME', label: 'Storage Account', placeholder: 'yourstorageaccount' },
+            { key: 'CONTAINER_REGISTRY', label: 'Container Registry', placeholder: 'registry.azurecr.io' },
+            { key: 'CONTRACT_SERVICE_URL', label: 'Contract Service URL', placeholder: 'https://...' },
+        ];
+
+        const grid = document.getElementById('commonVarsGrid');
+        grid.innerHTML = commonVars.map(v => {
+            if (v.type === 'select') {
+                return `
+                    <div class="form-group">
+                        <label class="form-label">${v.label}</label>
+                        <select class="form-select common-var" data-key="${v.key}">
+                            ${v.options.map(o => `<option value="${o}">${this.formatName(o)}</option>`).join('')}
+                        </select>
+                    </div>
+                `;
+            }
+            return `
+                <div class="form-group">
+                    <label class="form-label">${v.label}</label>
+                    <input type="text" class="form-input common-var" data-key="${v.key}" placeholder="${v.placeholder || ''}">
+                </div>
+            `;
+        }).join('');
+    }
+
+    renderScenarioSettings(vars) {
+        const grid = document.getElementById('scenarioVarsGrid');
+        
+        if (!vars || Object.keys(vars).length === 0) {
+            grid.innerHTML = '<p class="empty-hint">No scenario-specific variables</p>';
+            return;
+        }
+
+        grid.innerHTML = Object.entries(vars).map(([key, value]) => `
+            <div class="form-group">
+                <label class="form-label">${this.formatVarName(key)}</label>
+                <input type="text" class="form-input scenario-var" data-key="${key}" value="${value}">
+            </div>
+        `).join('');
+    }
+
+    loadSettings() {
+        fetch('/api/state').then(r => r.json()).then(data => {
+            const envVars = data.env_vars || {};
+            const scenarioVars = data.scenario_vars || {};
+
+            document.querySelectorAll('.common-var').forEach(el => {
+                const key = el.dataset.key;
+                if (envVars[key]) {
+                    el.value = envVars[key];
+                }
+            });
+
+            this.renderScenarioSettings(scenarioVars);
+        });
+    }
+
+    async saveSettings() {
+        const envVars = {};
+        document.querySelectorAll('.common-var').forEach(el => {
+            envVars[el.dataset.key] = el.value;
+        });
+
+        const scenarioVars = {};
+        document.querySelectorAll('.scenario-var').forEach(el => {
+            scenarioVars[el.dataset.key] = el.value;
+        });
+
+        try {
+            await fetch('/api/update-env', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ env_vars: envVars, scenario_vars: scenarioVars })
+            });
+            this.toast('Settings saved', 'success');
+        } catch {
+            this.toast('Failed to save settings', 'error');
+        }
+    }
+
+    // ============= Modal =============
+
+    openModal(scriptName) {
+        document.getElementById('outputModal').classList.add('active');
+        document.getElementById('modalScriptName').textContent = scriptName;
+        document.getElementById('terminalOutput').textContent = '';
+        document.getElementById('modalStatus').className = 'modal-status';
+        document.getElementById('modalStatus').innerHTML = '<span class="spinner"></span><span>Running...</span>';
+    }
+
+    closeModal() {
+        document.getElementById('outputModal').classList.remove('active');
+        if (this.state.eventSource) {
+            this.state.eventSource.close();
+            this.state.eventSource = null;
+        }
+    }
+
+    updateModalStatus(status) {
+        const el = document.getElementById('modalStatus');
+        if (status === 'completed') {
+            el.className = 'modal-status success';
+            el.innerHTML = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="16" height="16"><path d="M22 11.08V12a10 10 0 11-5.93-9.14"/><polyline points="22,4 12,14.01 9,11.01"/></svg><span>Completed</span>';
+            this.toast('Script completed', 'success');
+        } else if (status === 'failed') {
+            el.className = 'modal-status error';
+            el.innerHTML = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="16" height="16"><circle cx="12" cy="12" r="10"/><line x1="15" y1="9" x2="9" y2="15"/><line x1="9" y1="9" x2="15" y2="15"/></svg><span>Failed</span>';
+            this.toast('Script failed', 'error');
+        }
+    }
+
+    async cancelScript() {
+        await fetch('/api/cancel', { method: 'POST' });
+        this.closeModal();
+        this.toast('Script cancelled', 'info');
+    }
+
+    // ============= Utilities =============
+
+    formatName(str) {
+        return str.replace(/-/g, ' ').replace(/_/g, ' ').replace(/\b\w/g, l => l.toUpperCase());
+    }
+
+    formatVarName(key) {
+        return key.replace('AZURE_', '').replace(/_/g, ' ').replace(/\b\w/g, l => l.toUpperCase());
+    }
+
+    toast(message, type = 'info') {
+        const container = document.getElementById('toastContainer');
+        const toast = document.createElement('div');
+        toast.className = `toast ${type}`;
+        
+        const icons = {
+            success: '<path d="M22 11.08V12a10 10 0 11-5.93-9.14"/><polyline points="22,4 12,14.01 9,11.01"/>',
+            error: '<circle cx="12" cy="12" r="10"/><line x1="15" y1="9" x2="9" y2="15"/><line x1="9" y1="9" x2="15" y2="15"/>',
+            info: '<circle cx="12" cy="12" r="10"/><line x1="12" y1="16" x2="12" y2="12"/><line x1="12" y1="8" x2="12.01" y2="8"/>'
+        };
+        
+        toast.innerHTML = `
+            <svg class="toast-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">${icons[type] || icons.info}</svg>
+            <span class="toast-message">${message}</span>
+            <button class="toast-close" onclick="this.parentElement.remove()">
+                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" width="14" height="14"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+            </button>
+        `;
+        
+        container.appendChild(toast);
+        setTimeout(() => {
+            toast.style.animation = 'slideIn 0.25s ease reverse';
+            setTimeout(() => toast.remove(), 250);
+        }, 4000);
+    }
+}
+
+// Initialize
+document.addEventListener('DOMContentLoaded', () => {
+    window.app = new DepaTrainingApp();
+});
+
diff --git a/gui-demo/templates/index.html b/gui-demo/templates/index.html
new file mode 100644
index 0000000..ea33ff0
--- /dev/null
+++ b/gui-demo/templates/index.html
@@ -0,0 +1,337 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>DEPA Training | Dynamic Scenario Runner</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Geist+Mono:wght@400;500;600&family=Sora:wght@300;400;500;600;700&display=swap" rel="stylesheet">
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}">
+</head>
+<body>
+    <div class="app-container">
+        <!-- Animated Background -->
+        <div class="bg-mesh"></div>
+        
+        <!-- Header -->
+        <header class="header">
+            <div class="logo">
+                <div class="logo-icon">
+                    <svg viewBox="0 0 40 40" fill="none" xmlns="http://www.w3.org/2000/svg">
+                        <rect x="4" y="4" width="32" height="32" rx="8" stroke="currentColor" stroke-width="2"/>
+                        <path d="M14 20L18 24L26 16" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>
+                        <circle cx="20" cy="20" r="10" stroke="currentColor" stroke-width="1" stroke-dasharray="3 3" opacity="0.5"/>
+                    </svg>
+                </div>
+                <div class="logo-text">
+                    <span class="logo-title">DEPA Training</span>
+                    <span class="logo-subtitle">Dynamic Scenario Runner</span>
+                </div>
+            </div>
+            <nav class="nav-tabs">
+                <button class="nav-tab active" data-page="main">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polygon points="12,2 2,7 12,12 22,7"/><polyline points="2,17 12,22 22,17"/><polyline points="2,12 12,17 22,12"/></svg>
+                    Pipeline
+                </button>
+                <button class="nav-tab" data-page="config">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M14 2H6a2 2 0 00-2 2v16a2 2 0 002 2h12a2 2 0 002-2V8z"/><polyline points="14,2 14,8 20,8"/></svg>
+                    Config
+                </button>
+                <button class="nav-tab" data-page="logs">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="4,17 10,11 4,5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                    Logs
+                </button>
+                <button class="nav-tab" data-page="settings">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 00.33 1.82l.06.06a2 2 0 010 2.83 2 2 0 01-2.83 0l-.06-.06a1.65 1.65 0 00-1.82-.33 1.65 1.65 0 00-1 1.51V21a2 2 0 01-2 2 2 2 0 01-2-2v-.09A1.65 1.65 0 009 19.4a1.65 1.65 0 00-1.82.33l-.06.06a2 2 0 01-2.83 0 2 2 0 010-2.83l.06-.06a1.65 1.65 0 00.33-1.82 1.65 1.65 0 00-1.51-1H3a2 2 0 01-2-2 2 2 0 012-2h.09A1.65 1.65 0 004.6 9a1.65 1.65 0 00-.33-1.82l-.06-.06a2 2 0 010-2.83 2 2 0 012.83 0l.06.06a1.65 1.65 0 001.82.33H9a1.65 1.65 0 001-1.51V3a2 2 0 012-2 2 2 0 012 2v.09a1.65 1.65 0 001 1.51 1.65 1.65 0 001.82-.33l.06-.06a2 2 0 012.83 0 2 2 0 010 2.83l-.06.06a1.65 1.65 0 00-.33 1.82V9a1.65 1.65 0 001.51 1H21a2 2 0 012 2 2 2 0 01-2 2h-.09a1.65 1.65 0 00-1.51 1z"/></svg>
+                    Settings
+                </button>
+            </nav>
+            <div class="header-actions">
+                <div class="azure-status" id="azureStatus">
+                    <span class="status-dot"></span>
+                    <span class="status-text">Checking...</span>
+                </div>
+                <button class="btn btn-icon btn-shutdown" id="btnShutdown" title="Shutdown server">
+                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                        <path d="M18.36 6.64a9 9 0 1 1-12.73 0"/>
+                        <line x1="12" y1="2" x2="12" y2="12"/>
+                    </svg>
+                </button>
+            </div>
+        </header>
+
+        <!-- Main Content -->
+        <main class="main-content">
+            <!-- Page: Main Pipeline -->
+            <section class="page active" id="page-main">
+                <!-- Top Row: Azure + Scenario -->
+                <div class="top-row">
+                    <!-- Azure Connection -->
+                    <div class="card azure-card">
+                        <div class="card-header">
+                            <div class="card-icon azure-icon">
+                                <svg viewBox="0 0 24 24" fill="currentColor">
+                                    <path d="M13.05 4.24L6.56 18.4a.5.5 0 00.47.7h10.02a.4.4 0 00.35-.21l4.37-8.2a.5.5 0 00-.02-.52l-6.35-6a.5.5 0 00-.35-.13zM2.53 8.74l3.2 9.6a.5.5 0 00.47.36H6l5.17-11.58a.5.5 0 00-.05-.52L8.34 3.28a.5.5 0 00-.47-.18l-5 .9a.5.5 0 00-.34.74z"/>
+                                </svg>
+                            </div>
+                            <h2 class="card-title">Azure Connection</h2>
+                        </div>
+                        <div class="card-body">
+                            <div class="azure-not-logged-in" id="azureNotLoggedIn">
+                                <p class="hint-text">Connect to Azure to deploy training workloads</p>
+                                <button class="btn btn-azure" id="btnAzureLogin">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M15 3h4a2 2 0 012 2v14a2 2 0 01-2 2h-4"/><polyline points="10,17 15,12 10,7"/><line x1="15" y1="12" x2="3" y2="12"/></svg>
+                                    Sign in with Azure
+                                </button>
+                            </div>
+                            <div class="azure-logged-in hidden" id="azureLoggedIn">
+                                <div class="info-compact">
+                                    <div class="info-item">
+                                        <span class="info-label">Subscription</span>
+                                        <span class="info-value" id="subscriptionName">-</span>
+                                    </div>
+                                    <div class="info-item">
+                                        <span class="info-label">User</span>
+                                        <span class="info-value" id="userName">-</span>
+                                    </div>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+
+                    <!-- Scenario Selection -->
+                    <div class="card scenario-card">
+                        <div class="card-header">
+                            <div class="card-icon scenario-icon">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                    <path d="M21 16V8a2 2 0 00-1-1.73l-7-4a2 2 0 00-2 0l-7 4A2 2 0 003 8v8a2 2 0 001 1.73l7 4a2 2 0 002 0l7-4A2 2 0 0021 16z"/>
+                                </svg>
+                            </div>
+                            <h2 class="card-title">Scenario</h2>
+                            <button class="btn btn-icon btn-refresh" id="btnRefreshScenarios" title="Refresh scenarios">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="23,4 23,10 17,10"/><path d="M20.49 15a9 9 0 11-2.12-9.36L23 10"/></svg>
+                            </button>
+                        </div>
+                        <div class="card-body">
+                            <div class="scenario-selector">
+                                <select class="form-select scenario-dropdown" id="scenarioSelect">
+                                    <option value="">Select a scenario...</option>
+                                </select>
+                                <div class="scenario-info" id="scenarioInfo">
+                                    <span class="scenario-hint">Select a scenario to begin</span>
+                                </div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- Deployment Pipeline -->
+                <div class="card pipeline-card">
+                    <div class="card-header">
+                        <div class="card-icon pipeline-icon">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                <circle cx="12" cy="12" r="10"/><polyline points="12,6 12,12 16,14"/>
+                            </svg>
+                        </div>
+                        <h2 class="card-title">Deployment Pipeline</h2>
+                        <span class="card-badge" id="pipelineScenarioBadge">No scenario</span>
+                    </div>
+                    <div class="card-body">
+                        <div class="pipeline-container" id="pipelineContainer">
+                            <div class="pipeline-empty">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.5"><path d="M21 16V8a2 2 0 00-1-1.73l-7-4a2 2 0 00-2 0l-7 4A2 2 0 003 8v8a2 2 0 001 1.73l7 4a2 2 0 002 0l7-4A2 2 0 0021 16z"/></svg>
+                                <p>Select a scenario to see deployment steps</p>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- Deploy CCR -->
+                <div class="card deploy-card">
+                    <div class="card-header">
+                        <div class="card-icon deploy-icon">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                <polygon points="13,2 3,14 12,14 11,22 21,10 12,10"/>
+                            </svg>
+                        </div>
+                        <h2 class="card-title">Deploy Confidential Clean Room</h2>
+                    </div>
+                    <div class="card-body">
+                        <div class="deploy-form">
+                            <div class="form-group">
+                                <label class="form-label">Contract Sequence Number</label>
+                                <input type="number" class="form-input" id="contractSeqNo" value="0" min="0">
+                            </div>
+                            <button class="btn btn-primary btn-deploy" id="btnDeploy">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polygon points="5,3 19,12 5,21"/></svg>
+                                Deploy CCR
+                            </button>
+                        </div>
+                    </div>
+                </div>
+
+                <!-- Bottom Actions -->
+                <div class="bottom-actions">
+                    <div class="card action-card download-card">
+                        <div class="card-icon download-icon">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M21 15v4a2 2 0 01-2 2H5a2 2 0 01-2-2v-4"/><polyline points="7,10 12,15 17,10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
+                        </div>
+                        <div class="action-content">
+                            <h3>Download Model</h3>
+                            <p>Download and decrypt trained model</p>
+                        </div>
+                        <button class="btn btn-outline" id="btnDownload">Download</button>
+                    </div>
+                    <div class="card action-card cleanup-card">
+                        <div class="card-icon cleanup-icon">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="3,6 5,6 21,6"/><path d="M19 6v14a2 2 0 01-2 2H7a2 2 0 01-2-2V6m3 0V4a2 2 0 012-2h4a2 2 0 012 2v2"/></svg>
+                        </div>
+                        <div class="action-content">
+                            <h3>Cleanup</h3>
+                            <p>Delete resources</p>
+                        </div>
+                        <div class="dropdown">
+                            <button class="btn btn-danger dropdown-toggle" id="btnCleanup" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
+                                Delete
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" class="dropdown-arrow">
+                                    <polyline points="6,9 12,15 18,9"/>
+                                </svg>
+                            </button>
+                            <div class="dropdown-menu" id="cleanupDropdown">
+                                <button class="dropdown-item" id="btnCleanupContainer">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="2" y="3" width="20" height="18" rx="2"/><line x1="8" y1="21" x2="16" y2="21"/><line x1="12" y1="17" x2="12" y2="21"/></svg>
+                                    Delete Container Instance
+                                </button>
+                                <button class="dropdown-item dropdown-item-danger" id="btnCleanupResourceGroup">
+                                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M21 4H8l-7 8 7 8h13a2 2 0 002-2V6a2 2 0 00-2-2z"/><line x1="18" y1="9" x2="12" y2="15"/><line x1="12" y1="9" x2="18" y2="15"/></svg>
+                                    Delete Resource Group
+                                </button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </section>
+
+            <!-- Page: Config Editor -->
+            <section class="page" id="page-config">
+                <div class="card config-card full-height">
+                    <div class="card-header">
+                        <div class="card-icon config-icon">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M14 2H6a2 2 0 00-2 2v16a2 2 0 002 2h12a2 2 0 002-2V8z"/><polyline points="14,2 14,8 20,8"/></svg>
+                        </div>
+                        <h2 class="card-title">Pipeline Configuration</h2>
+                        <span class="editor-filename" id="configFilename">pipeline_config.json</span>
+                        <div class="card-actions">
+                            <button class="btn btn-outline btn-sm" id="btnReloadConfig">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="23,4 23,10 17,10"/><path d="M20.49 15a9 9 0 11-2.12-9.36L23 10"/></svg>
+                                Reload
+                            </button>
+                            <button class="btn btn-primary btn-sm" id="btnSaveConfig">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M19 21H5a2 2 0 01-2-2V5a2 2 0 012-2h11l5 5v11a2 2 0 01-2 2z"/></svg>
+                                Save
+                            </button>
+                        </div>
+                    </div>
+                    <div class="card-body">
+                        <div class="editor-wrapper">
+                            <textarea class="config-editor" id="configEditor" spellcheck="false" placeholder="Select a scenario to load configuration..."></textarea>
+                        </div>
+                    </div>
+                </div>
+            </section>
+
+            <!-- Page: Logs -->
+            <section class="page" id="page-logs">
+                <div class="card logs-card full-height">
+                    <div class="card-header">
+                        <div class="card-icon logs-icon">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="4,17 10,11 4,5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        </div>
+                        <h2 class="card-title">Container Logs</h2>
+                        <div class="container-status">
+                            <span class="status-label">Status:</span>
+                            <span class="status-value" id="containerStatusValue">Unknown</span>
+                        </div>
+                        <div class="card-actions">
+                            <button class="btn btn-outline btn-sm" id="btnRefreshLogs">
+                                <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="23,4 23,10 17,10"/><path d="M20.49 15a9 9 0 11-2.12-9.36L23 10"/></svg>
+                                Refresh
+                            </button>
+                        </div>
+                    </div>
+                    <div class="card-body">
+                        <div class="logs-wrapper">
+                            <pre class="logs-output" id="logsOutput">Select a scenario and deploy to view logs...</pre>
+                        </div>
+                    </div>
+                </div>
+            </section>
+
+            <!-- Page: Settings -->
+            <section class="page" id="page-settings">
+                <div class="card settings-card">
+                    <div class="card-header">
+                        <div class="card-icon settings-icon">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 00.33 1.82l.06.06a2 2 0 010 2.83 2 2 0 01-2.83 0l-.06-.06a1.65 1.65 0 00-1.82-.33 1.65 1.65 0 00-1 1.51V21a2 2 0 01-2 2 2 2 0 01-2-2v-.09A1.65 1.65 0 009 19.4a1.65 1.65 0 00-1.82.33l-.06.06a2 2 0 01-2.83 0 2 2 0 010-2.83l.06-.06a1.65 1.65 0 00.33-1.82 1.65 1.65 0 00-1.51-1H3a2 2 0 01-2-2 2 2 0 012-2h.09A1.65 1.65 0 004.6 9a1.65 1.65 0 00-.33-1.82l-.06-.06a2 2 0 010-2.83 2 2 0 012.83 0l.06.06a1.65 1.65 0 001.82.33H9a1.65 1.65 0 001-1.51V3a2 2 0 012-2 2 2 0 012 2v.09a1.65 1.65 0 001 1.51 1.65 1.65 0 001.82-.33l.06-.06a2 2 0 012.83 0 2 2 0 010 2.83l-.06.06a1.65 1.65 0 00-.33 1.82V9a1.65 1.65 0 001.51 1H21a2 2 0 012 2 2 2 0 01-2 2h-.09a1.65 1.65 0 00-1.51 1z"/></svg>
+                        </div>
+                        <h2 class="card-title">Environment Settings</h2>
+                        <button class="btn btn-primary btn-sm" id="btnSaveSettings">
+                            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M19 21H5a2 2 0 01-2-2V5a2 2 0 012-2h11l5 5v11a2 2 0 01-2 2z"/></svg>
+                            Save
+                        </button>
+                    </div>
+                    <div class="card-body">
+                        <div class="settings-section">
+                            <h3 class="settings-title">Azure Configuration</h3>
+                            <div class="settings-grid" id="commonVarsGrid">
+                                <!-- Dynamically populated -->
+                            </div>
+                        </div>
+                        <div class="settings-section">
+                            <h3 class="settings-title">Scenario Variables <span class="scenario-tag" id="settingsScenarioTag">-</span></h3>
+                            <div class="settings-grid" id="scenarioVarsGrid">
+                                <p class="empty-hint">Select a scenario to configure its variables</p>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </section>
+        </main>
+
+        <!-- Terminal Modal -->
+        <div class="modal" id="outputModal">
+            <div class="modal-backdrop"></div>
+            <div class="modal-content">
+                <div class="modal-header">
+                    <div class="modal-title">
+                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="4,17 10,11 4,5"/><line x1="12" y1="19" x2="20" y2="19"/></svg>
+                        <span id="modalScriptName">Running Script</span>
+                    </div>
+                    <button class="btn btn-icon" id="btnCloseModal">
+                        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>
+                    </button>
+                </div>
+                <div class="modal-body">
+                    <div class="terminal">
+                        <pre class="terminal-output" id="terminalOutput"></pre>
+                    </div>
+                </div>
+                <div class="modal-footer">
+                    <div class="modal-status" id="modalStatus">
+                        <span class="spinner"></span>
+                        <span>Running...</span>
+                    </div>
+                    <button class="btn btn-outline" id="btnCancelScript">Cancel</button>
+                </div>
+            </div>
+        </div>
+
+        <!-- Toast Container -->
+        <div class="toast-container" id="toastContainer"></div>
+    </div>
+
+    <script src="{{ url_for('static', filename='js/app.js') }}"></script>
+</body>
+</html>
+
diff --git a/install-prerequisites.sh b/install-prerequisites.sh
index 91cdea0..add78ed 100755
--- a/install-prerequisites.sh
+++ b/install-prerequisites.sh
@@ -137,14 +137,14 @@ else
     record_result "Azure CLI ext: confcom" "Installed Now" "$ver"
 fi
 
-# --- Docker group setup ---
-if groups "$USER" | grep &>/dev/null '\bdocker\b'; then
-    echo "[OK] User '$USER' is already in docker group."
-else
-    echo "[Adding] User '$USER' to docker group..."
-    sudo usermod -aG docker "$USER"
-    echo "You may need to log out and log back in for docker group changes to take effect."
-fi
+# # --- Docker group setup ---
+# if groups "$USER" | grep &>/dev/null '\bdocker\b'; then
+#     echo "[OK] User '$USER' is already in docker group."
+# else
+#     echo "[Adding] User '$USER' to docker group..."
+#     sudo usermod -aG docker "$USER"
+#     echo "You may need to log out and log back in for docker group changes to take effect."
+# fi
 
 # --- Summary Table ---
 echo
diff --git a/launch-demo.sh b/launch-demo.sh
new file mode 100755
index 0000000..35925e9
--- /dev/null
+++ b/launch-demo.sh
@@ -0,0 +1,107 @@
+#!/bin/bash
+#
+# DEPA Training Demo - Modular GUI Edition
+# ================================================
+# Launches the dynamic web UI that auto-discovers any training scenario
+#
+
+set -e
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+CYAN='\033[0;36m'
+BOLD='\033[1m'
+NC='\033[0m'
+
+# Banner
+echo -e "${CYAN}"
+echo "╔══════════════════════════════════════════════════════════════════╗"
+echo "║                                                                  ║"
+echo "║    ██████╗ ███████╗██████╗  █████╗     ████████╗██████╗          ║"
+echo "║    ██╔══██╗██╔════╝██╔══██╗██╔══██╗    ╚══██╔══╝██╔══██╗         ║"
+echo "║    ██║  ██║█████╗  ██████╔╝███████║       ██║   ██████╔╝         ║"
+echo "║    ██║  ██║██╔══╝  ██╔═══╝ ██╔══██║       ██║   ██╔══██╗         ║"
+echo "║    ██████╔╝███████╗██║     ██║  ██║       ██║   ██║  ██║         ║"
+echo "║    ╚═════╝ ╚══════╝╚═╝     ╚═╝  ╚═╝       ╚═╝   ╚═╝  ╚═╝         ║"
+echo "║                                                                  ║"
+echo "║              Dynamic Scenario Runner - Modular GUI App           ║"
+echo "║                                                                  ║"
+echo "╚══════════════════════════════════════════════════════════════════╝"
+echo -e "${NC}"
+
+# Paths
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+export REPO_ROOT="$SCRIPT_DIR"
+export TOOLS_HOME="$REPO_ROOT/external/confidential-sidecar-containers/tools"
+DEMO_UI_DIR="$REPO_ROOT/gui-demo"
+PORT=${PORT:-5001}
+
+echo -e "${CYAN}[*]${NC} Repository: $REPO_ROOT"
+echo ""
+
+# Install prerequisites
+command_exists() { command -v "$1" >/dev/null 2>&1; }
+
+echo -e "${CYAN}[*]${NC} Installing prerequisites..."
+./install-prerequisites.sh
+
+# Setup Python environment
+echo -e "${CYAN}[*]${NC} Setting up Python environment..."
+cd "$DEMO_UI_DIR"
+
+if [ ! -d "venv" ]; then
+    python3 -m venv venv
+fi
+
+source venv/bin/activate
+pip install -q -r requirements.txt 2>/dev/null
+echo -e "${GREEN}[✓]${NC} Python environment ready"
+echo ""
+
+# Find available port
+if lsof -Pi :$PORT -sTCP:LISTEN -t >/dev/null 2>&1; then
+    echo -e "${YELLOW}[!]${NC} Port $PORT in use, finding alternative..."
+    for p in 5002 5003 5004 8080 8000 3000; do
+        if ! lsof -Pi :$p -sTCP:LISTEN -t >/dev/null 2>&1; then
+            PORT=$p
+            break
+        fi
+    done
+fi
+
+# Get local IP
+LOCAL_IP=$(hostname -I 2>/dev/null | awk '{print $1}' || echo "localhost")
+
+# Discover scenarios
+echo -e "${CYAN}[*]${NC} Discovering scenarios..."
+SCENARIO_COUNT=$(ls -d "$REPO_ROOT/scenarios"/*/ 2>/dev/null | wc -l)
+echo -e "${GREEN}[✓]${NC} Found ${BOLD}$SCENARIO_COUNT${NC} scenarios"
+echo ""
+
+# Launch
+echo -e "${GREEN}╔══════════════════════════════════════════════════════════════════╗${NC}"
+echo -e "${GREEN}║${NC}                                                                  ${GREEN}║${NC}"
+echo -e "${GREEN}║${NC}  ${BOLD}DEPA Training Demo - Modular GUI Edition${NC}                        ${GREEN}║${NC}"
+echo -e "${GREEN}║${NC}                                                                  ${GREEN}║${NC}"
+echo -e "${GREEN}║${NC}  ${CYAN}Local:${NC}    http://localhost:${PORT}                                 ${GREEN}║${NC}"
+echo -e "${GREEN}║${NC}  ${CYAN}Network:${NC}  http://${LOCAL_IP}:${PORT}                              ${GREEN}║${NC}"
+echo -e "${GREEN}║${NC}                                                                  ${GREEN}║${NC}"
+echo -e "${GREEN}║${NC}                                                                  ${GREEN}║${NC}"
+echo -e "${GREEN}║${NC}  Press ${YELLOW}Ctrl+C${NC} to stop                                            ${GREEN}║${NC}"
+echo -e "${GREEN}║${NC}                                                                  ${GREEN}║${NC}"
+echo -e "${GREEN}╚══════════════════════════════════════════════════════════════════╝${NC}"
+echo ""
+
+# Open browser
+sleep 2
+if command_exists xdg-open; then
+    xdg-open "http://localhost:$PORT" 2>/dev/null &
+elif command_exists open; then
+    open "http://localhost:$PORT" 2>/dev/null &
+fi
+
+# Start server
+python3 app.py $PORT
+
diff --git a/scenarios/brats/.gitignore b/scenarios/brats/.gitignore
index ed87890..91eefe0 100644
--- a/scenarios/brats/.gitignore
+++ b/scenarios/brats/.gitignore
@@ -13,7 +13,7 @@
 *.hdf5
 
 # Ignore modeller output folder (relative to repo root)
-modeller/output/
+modeller/
 
 # Ignore any folder named preprocessed (anywhere)
 preprocessed/
diff --git a/scenarios/brats/README.md b/scenarios/brats/README.md
index df2a8ff..8857920 100644
--- a/scenarios/brats/README.md
+++ b/scenarios/brats/README.md
@@ -2,7 +2,8 @@
 
 ## Scenario Type
 
-| Scenario name | Scenario type | Task type | Privacy | No. of TDPs* | Data type (format) | Model type (format) | Join type (No. of datasets) | 
+
+| Scenario name | Scenario type | Task type | Privacy | No. of TDPs* | Data type (format) | Model type (format) | Join type (No. of datasets) |
 |--------------|---------------|-----------------|--------------|-----------|------------|------------|------------|
 | BraTS | Training - Deep Learning | Image Segmentation | Differentially Private | 4 | MRI scans data (NIfTI/PNG) | UNet (Safetensors) | Vertical (4)|
 
@@ -10,7 +11,7 @@
 
 ## Scenario Description
 
-This scenario demonstrates how a deep learning model can be trained for Brain MRI Tumor Segmentation using the join of multiple medical imaging datasets (potentially PII sensitive, due to combination of quasi-identifiers such as biodata or possiblity of volumetric facial reconstruction). The Training Data Consumer (TDC) building the model gets into a contractual agreement with multiple Training Data Providers (TDPs) having annotated MRI data, and the model is trained on the joined datasets in a data-blind manner within the CCR, maintaining privacy guarantees (as per need, keeping in mind the privacy-utility trade-off) using differential privacy. For demonstration purpose, this scenario uses annotated Brain MRI data made available through the BraTS 2020 challenge [[1, 2, 3]](README.md#references), and a custom UNet architecture model for segmentation.
+This scenario demonstrates how a deep learning model can be trained for Brain MRI Tumor Segmentation using the join of multiple medical imaging datasets (potentially PII sensitive, due to combination of quasi-identifiers such as biodata or possibility of volumetric facial reconstruction). The Training Data Consumer (TDC) building the model gets into a contractual agreement with multiple Training Data Providers (TDPs) having annotated MRI data, and the model is trained on the joined datasets in a data-blind manner within the CCR, maintaining privacy guarantees (as per need, keeping in mind the privacy-utility trade-off) using differential privacy. For demonstration purpose, this scenario uses annotated Brain MRI data made available through the BraTS 2020 challenge [[1, 2, 3]](README.md#references), and a custom UNet architecture model for segmentation.
 
 The end-to-end training pipeline consists of the following phases:
 
@@ -37,7 +38,7 @@ This script builds the following container images:
 - `preprocess-brats-a, preprocess-brats-b, preprocess-brats-c`: Containers that pre-process the individual MRI datasets
 - `brats-model-save`: Container that saves the base model to be trained.
 
-Alternatively, you can pull and use pre-built container images from the ispirt container registry by setting the following environment variable. Docker hub has started throttling which may effect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
+Alternatively, you can pull and use pre-built container images from the iSPIRT container registry by setting the following environment variable. Docker hub has started throttling which may affect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
 
 ```bash
 export CONTAINER_REGISTRY=ispirt.azurecr.io
@@ -76,7 +77,7 @@ Assuming you have cleartext access to all the datasets, you can train the model
 ./train.sh
 ```
 
-The script joins the datasets and trains the model using a pipeline configuration. To modify the various components of the training pipeline, you can edit the training config files in the [config](./config/) directory. The training config files are used to create the pipeline configuration ([pipeline_config.json](./config/pipeline_config.json)) created by consolidating all the TDC's training config files, namely the [model config](./config/model_config.json), [dataset config](./config/dataset_config.json), [loss function config](./config/loss_config.json), [training config](./config/train_config_template.json), [evaluation config](./config/eval_config.json), and if multiple datasets are used, the [data join config](./config/join_config.json). These enable the TDC to design highly customized training pipelines without requiring review and approval of new custom code for each use case—reducing risks from potentially malicious or non-compliant code. The consolidated pipeline configuration is then attested against the signed contract using the TDP’s policy-as-code. If approved, it is executed in the CCR to train the model, which we will deploy in the next section.
+The script joins the datasets and trains the model using a pipeline configuration. To modify the various components of the training pipeline, you can edit the training config files in the [config](./config/) directory. The training config files are used to create the pipeline configuration ([pipeline_config.json](./config/pipeline_config.json)) created by consolidating all the TDC's training config files, namely the [model config](./config/model_config.json), [dataset config](./config/dataset_config.json), [loss function config](./config/loss_config.json), [training config](./config/train_config_template.json), [evaluation config](./config/eval_config.json), and if multiple datasets are used, the [data join config](./config/join_config.json). These enable the TDC to design highly customized training pipelines without requiring review and approval of new custom code for each use case — reducing risks from potentially malicious or non-compliant code. The consolidated pipeline configuration is then attested against the signed contract using the TDP's policy-as-code. If approved, it is executed in the CCR to train the model, which we will deploy in the next section.
 
 ```mermaid
 flowchart TD
@@ -109,10 +110,10 @@ If all goes well, you should see output similar to the following output, and the
 
 ```bash
 train-1  | Merged dataset 'brats_A' into '/tmp/brats_joined'
-train-1  | Merged dataset 'brat_B' into '/tmp/brats_joined'
+train-1  | Merged dataset 'brats_B' into '/tmp/brats_joined'
 train-1  | Merged dataset 'brats_C' into '/tmp/brats_joined'
 train-1  | Merged dataset 'brats_D' into '/tmp/brats_joined'
-train-1  | 
+train-1  |
 train-1  | All datasets joined in: /tmp/brats_joined
 train-1  | Training samples: 228
 train-1  | Validation samples: 66
@@ -125,14 +126,14 @@ train-1  | Scheduler CyclicLR loaded from config
 train-1  | Custom loss function loaded from config
 train-1  | Epoch 1/1 completed | Training Loss: 1.8462 | Epsilon: 1.4971
 train-1  | Epoch 1/1 completed | Validation Loss: 1.8034
-train-1  | 
+train-1  |
 train-1  | Training non-private replica model for comparison...
 train-1  | Non-private baseline model - Epoch 1/1 completed | Training Loss: 1.7808
 train-1  | Non-private baseline model - Epoch 1/1 completed | Validation Loss: 1.6784
 train-1  | Saving trained model to /mnt/remote/output/trained_model.pth
 train-1  | Evaluation Metrics: {'test_loss': 1.8256315231323241, 'dice_score': 0.00021866214829874793, 'jaccard_index': 0.00010934302874015687, 'hausdorff_distance': 99.54396013822235}
 train-1  | CCR Training complete!
-train-1  | 
+train-1  |
 train-1 exited with code 0
 ```
 
@@ -142,22 +143,22 @@ Now that training has run successfully locally, let's move on to the actual exec
 
 ## Deploy on CCR
 
-In a more realistic scenario, these datasets will not be available in the clear to the TDC, and the TDC will be required to use a CCR for training her model. The following steps describe the process of sharing encrypted datasets with TDCs and setting up a CCR in Azure for training models. Please stay tuned for CCR on other cloud platforms. 
+In a more realistic scenario, these datasets will not be available in the clear to the TDC, and the TDC will be required to use a CCR for training her model. The following steps describe the process of sharing encrypted datasets with TDCs and setting up a CCR in Azure for training models. Please stay tuned for CCR on other cloud platforms.
 
-To deploy in Azure, you will need the following. 
+To deploy in Azure, you will need the following.
 
-- Docker Hub account to store container images. Alternatively, you can use pre-built images from the ```ispirt``` container registry. 
-- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) to store encryption keys and implement secure key release to CCR. You can either you Azure Key Vault Premium (lower cost), or [Azure Key Vault managed HSM](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) for enhanced security. Please see instructions below on how to create and setup your AKV instance. 
-- Valid Azure subscription with sufficient access to create key vault, storage accounts, storage containers, and Azure Container Instances (ACI). 
+- Docker Hub account to store container images. Alternatively, you can use pre-built images from the ```iSPIRT``` container registry.
+- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) to store encryption keys and implement secure key release to CCR. You can either use Azure Key Vault Premium (lower cost), or [Azure Key Vault managed HSM](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) for enhanced security. Please see instructions below on how to create and set up your AKV instance.
+- Valid Azure subscription with sufficient access to create key vault, storage accounts, storage containers, and Azure Container Instances (ACI).
 
-If you are using your own development environment instead of a dev container or codespaces, you will to install the following dependencies. 
+If you are using your own development environment instead of a dev container or codespaces, you will need to install the following dependencies.
 
 - [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux).  
 - [Azure CLI Confidential containers extension](https://learn.microsoft.com/en-us/cli/azure/confcom?view=azure-cli-latest). After installing Azure CLI, you can install this extension using ```az extension add --name confcom -y```
 - [Go](https://go.dev/doc/install). Follow the instructions to install Go. After installing, ensure that the PATH environment variable is set to include ```go``` runtime.
 - ```jq```. You can install jq using ```sudo apt-get install -y jq```
 
-We will be creating the following resources as part of the deployment. 
+We will be creating the following resources as part of the deployment.
 
 - Azure Key Vault
 - Azure Storage account
@@ -266,7 +267,7 @@ cd $REPO_ROOT/scenarios/$SCENARIO/deployment/azure
 
 ### 3\. Contract Signing
 
-Navigate to the [contract-ledger](https://github.com/kapilvgit/contract-ledger/blob/main/README.md) repository and follow the instructions for contract signing.
+Navigate to the [contract-service](https://github.com/iSPIRT/contract-service/blob/main/README.md) repository and follow the instructions for contract signing.
 
 Once the contract is signed, export the contract sequence number as an environment variable in the same terminal where you set the environment variables for the deployment.
 
@@ -278,14 +279,14 @@ export CONTRACT_SEQ_NO=<contract-sequence-number>
 
 ### 4\. Data Encryption and Upload
 
-Using their respective keys, the TDPs and TDC encrypt their datasets and model (respectively) and upload them to the Storage containers created in the previous step.
+Using their respective keys, the TDPs and TDC encrypt their datasets and models (respectively) and upload them to the Storage containers created in the previous step.
 
 Navigate to the [Azure deployment](./deployment/azure/) directory and execute the scripts for key import, data encryption and upload to Azure Blob Storage, in preparation of the CCR deployment.
 
-The import-keys script generates and imports encryption keys into Azure Key Vault with a policy based on [policy-in-template.json](./policy/policy-in-template.json). The policy requires that the CCRs run specific containers with a specific configuration which includes the public identity of the contract service. Only CCRs that satisfy this policy will be granted access to the encryption keys. The generated keys are available as files with the extension `.bin`. 
+The import-keys script generates and imports encryption keys into Azure Key Vault with a policy based on [policy-in-template.json](./policy/policy-in-template.json). The policy requires that the CCRs run specific containers with a specific configuration which includes the public identity of the contract service. Only CCRs that satisfy this policy will be granted access to the encryption keys. The generated keys are available as files with the extension `.bin`.
 
 ```bash
-export CONTRACT_SERVICE_URL=https://depa-training-contract-service.centralindia.cloudapp.azure.com:8000
+export CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
 export TOOLS_HOME=$REPO_ROOT/external/confidential-sidecar-containers/tools
 
 ./3-import-keys.sh
@@ -320,9 +321,7 @@ Set the `$CONTRACT_SEQ_NO` variable to the exact value of the contract sequence
 export CONTRACT_SEQ_NO=15
 ```
 
-This script will deploy the container images from your container registry, including the encrypted filesystem sidecar. The sidecar will generate an SEV-SNP attestation report, generate an attestation token using the Microsoft Azure Attestation (MAA) service, retrieve dataset, model and output encryption keys from the TDP and TDC's Azure Key Vault, train the model, and save the resulting model into TDC's output filesystem image, which the TDC can later decrypt. 
-
-<!-- **Note:** if the contract-ledger repository is also located at the root of the same environment where this depa-training repo is, the `$CONTRACT_SEQ_NO` variable automatically picks up the sequence number of the latest contract that was signed between the TDPs and TDC. -->
+This script will deploy the container images from your container registry, including the encrypted filesystem sidecar. The sidecar will generate an SEV-SNP attestation report, generate an attestation token using the Microsoft Azure Attestation (MAA) service, retrieve dataset, model and output encryption keys from the TDP and TDC's Azure Key Vault, train the model, and save the resulting model into TDC's output filesystem image, which the TDC can later decrypt.
 
 **Note:** The completion of this script's execution simply creates a CCR instance, and doesn't indicate whether training has completed or not. The training process might still be ongoing. Poll the container logs (see below) to track progress until training is complete.
 
@@ -370,7 +369,7 @@ cd mnt/remote && ls
 
 ### 6\. Download and Decrypt Model
 
-Once training has completed succesfully (The training container logs will mention it explicitly), download and decrypt the trained model and other training outputs.
+Once training has completed successfully (The training container logs will mention it explicitly), download and decrypt the trained model and other training outputs.
 
 ```bash
 ./6-download-decrypt-model.sh
@@ -381,7 +380,7 @@ The outputs will be saved to the [output](./modeller/output/) directory.
 To check if the trained model is fresh, you can run the following command:
 
 ```bash
-stat $REPO_ROOT/scenarios/$SCENARIO/modeller/output/trained_model.pth
+stat $REPO_ROOT/scenarios/$SCENARIO/modeller/output/trained_model.safetensors
 ```
 
 ---
diff --git a/scenarios/brats/config/model_config_old.json b/scenarios/brats/config/model_config_old.json
deleted file mode 100644
index b6d558e..0000000
--- a/scenarios/brats/config/model_config_old.json
+++ /dev/null
@@ -1,889 +0,0 @@
-{
-    "layers": {
-        "input_conv": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 1,
-                "out_channels": 8,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "input"
-            ]
-        },
-        "down_conv1_0": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 8,
-                "out_channels": 16,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "input_conv"
-            ]
-        },
-        "down_norm1_0": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 16
-            },
-            "inputs": [
-                "down_conv1_0"
-            ]
-        },
-        "down_relu1_0": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "down_norm1_0"
-            ]
-        },
-        "down_conv2_0": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 16,
-                "out_channels": 16,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "down_relu1_0"
-            ]
-        },
-        "down_norm2_0": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 16
-            },
-            "inputs": [
-                "down_conv2_0"
-            ]
-        },
-        "down_relu2_0": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "down_norm2_0"
-            ]
-        },
-        "down_pool_0": {
-            "type": "maxpool2d",
-            "params": {
-                "kernel_size": 2,
-                "stride": 2
-            },
-            "inputs": [
-                "down_relu2_0"
-            ]
-        },
-        "down_conv1_1": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 16,
-                "out_channels": 32,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "down_pool_0"
-            ]
-        },
-        "down_norm1_1": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 32
-            },
-            "inputs": [
-                "down_conv1_1"
-            ]
-        },
-        "down_relu1_1": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "down_norm1_1"
-            ]
-        },
-        "down_conv2_1": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 32,
-                "out_channels": 32,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "down_relu1_1"
-            ]
-        },
-        "down_norm2_1": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 32
-            },
-            "inputs": [
-                "down_conv2_1"
-            ]
-        },
-        "down_relu2_1": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "down_norm2_1"
-            ]
-        },
-        "down_pool_1": {
-            "type": "maxpool2d",
-            "params": {
-                "kernel_size": 2,
-                "stride": 2
-            },
-            "inputs": [
-                "down_relu2_1"
-            ]
-        },
-        "down_conv1_2": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 32,
-                "out_channels": 64,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "down_pool_1"
-            ]
-        },
-        "down_norm1_2": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 64
-            },
-            "inputs": [
-                "down_conv1_2"
-            ]
-        },
-        "down_relu1_2": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "down_norm1_2"
-            ]
-        },
-        "down_conv2_2": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 64,
-                "out_channels": 64,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "down_relu1_2"
-            ]
-        },
-        "down_norm2_2": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 64
-            },
-            "inputs": [
-                "down_conv2_2"
-            ]
-        },
-        "down_relu2_2": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "down_norm2_2"
-            ]
-        },
-        "down_pool_2": {
-            "type": "maxpool2d",
-            "params": {
-                "kernel_size": 2,
-                "stride": 2
-            },
-            "inputs": [
-                "down_relu2_2"
-            ]
-        },
-        "down_conv1_3": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 64,
-                "out_channels": 128,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "down_pool_2"
-            ]
-        },
-        "down_norm1_3": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 128
-            },
-            "inputs": [
-                "down_conv1_3"
-            ]
-        },
-        "down_relu1_3": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "down_norm1_3"
-            ]
-        },
-        "down_conv2_3": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 128,
-                "out_channels": 128,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "down_relu1_3"
-            ]
-        },
-        "down_norm2_3": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 128
-            },
-            "inputs": [
-                "down_conv2_3"
-            ]
-        },
-        "down_relu2_3": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "down_norm2_3"
-            ]
-        },
-        "down_pool_3": {
-            "type": "maxpool2d",
-            "params": {
-                "kernel_size": 2,
-                "stride": 2
-            },
-            "inputs": [
-                "down_relu2_3"
-            ]
-        },
-        "bottleneck_conv1": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 128,
-                "out_channels": 256,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "down_pool_3"
-            ]
-        },
-        "bottleneck_norm1": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 256
-            },
-            "inputs": [
-                "bottleneck_conv1"
-            ]
-        },
-        "bottleneck_relu1": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "bottleneck_norm1"
-            ]
-        },
-        "bottleneck_conv2": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 256,
-                "out_channels": 256,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "bottleneck_relu1"
-            ]
-        },
-        "bottleneck_norm2": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 256
-            },
-            "inputs": [
-                "bottleneck_conv2"
-            ]
-        },
-        "bottleneck_relu2": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "bottleneck_norm2"
-            ]
-        },
-        "up_interpolate_3": {
-            "type": "interpolate",
-            "params": {
-                "scale_factor": 2.0,
-                "mode": "bilinear",
-                "align_corners": false
-            },
-            "inputs": [
-                "bottleneck_relu2"
-            ]
-        },
-        "up_conv_3": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 256,
-                "out_channels": 128,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "up_interpolate_3"
-            ]
-        },
-        "up_norm_3": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 128
-            },
-            "inputs": [
-                "up_conv_3"
-            ]
-        },
-        "up_relu_3": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_norm_3"
-            ]
-        },
-        "skip_concat_3": {
-            "type": "concat",
-            "params": {
-                "dim": 1
-            },
-            "inputs": [
-                "down_relu2_3",
-                "up_relu_3"
-            ]
-        },
-        "up_conv_block1_3": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 256,
-                "out_channels": 128,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "skip_concat_3"
-            ]
-        },
-        "up_conv_norm1_3": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 128
-            },
-            "inputs": [
-                "up_conv_block1_3"
-            ]
-        },
-        "up_conv_relu1_3": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_conv_norm1_3"
-            ]
-        },
-        "up_conv_block2_3": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 128,
-                "out_channels": 128,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "up_conv_relu1_3"
-            ]
-        },
-        "up_conv_norm2_3": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 128
-            },
-            "inputs": [
-                "up_conv_block2_3"
-            ]
-        },
-        "up_conv_relu2_3": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_conv_norm2_3"
-            ]
-        },
-        "up_interpolate_2": {
-            "type": "interpolate",
-            "params": {
-                "scale_factor": 2.0,
-                "mode": "bilinear",
-                "align_corners": false
-            },
-            "inputs": [
-                "up_conv_relu2_3"
-            ]
-        },
-        "up_conv_2": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 128,
-                "out_channels": 64,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "up_interpolate_2"
-            ]
-        },
-        "up_norm_2": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 64
-            },
-            "inputs": [
-                "up_conv_2"
-            ]
-        },
-        "up_relu_2": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_norm_2"
-            ]
-        },
-        "skip_concat_2": {
-            "type": "concat",
-            "params": {
-                "dim": 1
-            },
-            "inputs": [
-                "down_relu2_2",
-                "up_relu_2"
-            ]
-        },
-        "up_conv_block1_2": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 128,
-                "out_channels": 64,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "skip_concat_2"
-            ]
-        },
-        "up_conv_norm1_2": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 64
-            },
-            "inputs": [
-                "up_conv_block1_2"
-            ]
-        },
-        "up_conv_relu1_2": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_conv_norm1_2"
-            ]
-        },
-        "up_conv_block2_2": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 64,
-                "out_channels": 64,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "up_conv_relu1_2"
-            ]
-        },
-        "up_conv_norm2_2": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 64
-            },
-            "inputs": [
-                "up_conv_block2_2"
-            ]
-        },
-        "up_conv_relu2_2": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_conv_norm2_2"
-            ]
-        },
-        "up_interpolate_1": {
-            "type": "interpolate",
-            "params": {
-                "scale_factor": 2.0,
-                "mode": "bilinear",
-                "align_corners": false
-            },
-            "inputs": [
-                "up_conv_relu2_2"
-            ]
-        },
-        "up_conv_1": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 64,
-                "out_channels": 32,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "up_interpolate_1"
-            ]
-        },
-        "up_norm_1": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 32
-            },
-            "inputs": [
-                "up_conv_1"
-            ]
-        },
-        "up_relu_1": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_norm_1"
-            ]
-        },
-        "skip_concat_1": {
-            "type": "concat",
-            "params": {
-                "dim": 1
-            },
-            "inputs": [
-                "down_relu2_1",
-                "up_relu_1"
-            ]
-        },
-        "up_conv_block1_1": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 64,
-                "out_channels": 32,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "skip_concat_1"
-            ]
-        },
-        "up_conv_norm1_1": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 32
-            },
-            "inputs": [
-                "up_conv_block1_1"
-            ]
-        },
-        "up_conv_relu1_1": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_conv_norm1_1"
-            ]
-        },
-        "up_conv_block2_1": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 32,
-                "out_channels": 32,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "up_conv_relu1_1"
-            ]
-        },
-        "up_conv_norm2_1": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 32
-            },
-            "inputs": [
-                "up_conv_block2_1"
-            ]
-        },
-        "up_conv_relu2_1": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_conv_norm2_1"
-            ]
-        },
-        "up_interpolate_0": {
-            "type": "interpolate",
-            "params": {
-                "scale_factor": 2.0,
-                "mode": "bilinear",
-                "align_corners": false
-            },
-            "inputs": [
-                "up_conv_relu2_1"
-            ]
-        },
-        "up_conv_0": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 32,
-                "out_channels": 16,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "up_interpolate_0"
-            ]
-        },
-        "up_norm_0": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 16
-            },
-            "inputs": [
-                "up_conv_0"
-            ]
-        },
-        "up_relu_0": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_norm_0"
-            ]
-        },
-        "skip_concat_0": {
-            "type": "concat",
-            "params": {
-                "dim": 1
-            },
-            "inputs": [
-                "down_relu2_0",
-                "up_relu_0"
-            ]
-        },
-        "up_conv_block1_0": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 32,
-                "out_channels": 16,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "skip_concat_0"
-            ]
-        },
-        "up_conv_norm1_0": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 16
-            },
-            "inputs": [
-                "up_conv_block1_0"
-            ]
-        },
-        "up_conv_relu1_0": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_conv_norm1_0"
-            ]
-        },
-        "up_conv_block2_0": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 16,
-                "out_channels": 16,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "up_conv_relu1_0"
-            ]
-        },
-        "up_conv_norm2_0": {
-            "type": "groupnorm",
-            "params": {
-                "num_groups": 1,
-                "num_channels": 16
-            },
-            "inputs": [
-                "up_conv_block2_0"
-            ]
-        },
-        "up_conv_relu2_0": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "up_conv_norm2_0"
-            ]
-        },
-        "out_conv1": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 16,
-                "out_channels": 8,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "up_conv_relu2_0"
-            ]
-        },
-        "out_relu": {
-            "type": "leaky_relu",
-            "params": {
-                "negative_slope": 0.1
-            },
-            "inputs": [
-                "out_conv1"
-            ]
-        },
-        "out_conv2": {
-            "type": "conv2d",
-            "params": {
-                "in_channels": 8,
-                "out_channels": 1,
-                "kernel_size": 3,
-                "stride": 1,
-                "padding": 1
-            },
-            "inputs": [
-                "out_relu"
-            ]
-        },
-        "final_output": {
-            "type": "sigmoid",
-            "inputs": [
-                "out_conv2"
-            ]
-        }
-    },
-    "outputs": [
-        "final_output"
-    ]
-}
\ No newline at end of file
diff --git a/scenarios/brats/contract/contract.json b/scenarios/brats/contract/contract.json
index 0204000..ad54ae0 100644
--- a/scenarios/brats/contract/contract.json
+++ b/scenarios/brats/contract/contract.json
@@ -9,7 +9,8 @@
   "datasets": [
     {
       "id": "19517ba8-bab8-11ed-afa1-0242ac120002",
-      "name": "brats_A",
+      "owner": "brats_A",
+      "name": "BraTS_Brain_MRI_set_A",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_BRATS_A_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -25,7 +26,8 @@
     },
     {
       "id": "216d5cc6-bab8-11ed-afa1-0242ac120002",
-      "name": "brats_B",
+      "owner": "brats_B",
+      "name": "BraTS_Brain_MRI_set_B",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_BRATS_B_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -41,7 +43,8 @@
     },
     {
       "id": "2830a144-bab8-11ed-afa1-0242ac120002",
-      "name": "brats_C",
+      "owner": "brats_C",
+      "name": "BraTS_Brain_MRI_set_C",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_BRATS_C_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -57,7 +60,8 @@
     },
     {
       "id": "2a3b0c4e-bab8-11ed-afa1-0242ac120002",
-      "name": "brats_D",
+      "owner": "brats_D",
+      "name": "BraTS_Brain_MRI_set_D",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_BRATS_D_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -79,30 +83,22 @@
         {
           "dataset": "19517ba8-bab8-11ed-afa1-0242ac120002",
           "epsilon_threshold": "1.5",
-          "noise_multiplier": "2.0",
-          "delta": "0.01",
-          "epochs_per_report": "2"
+          "delta": "0.01"
         },
         {
           "dataset": "216d5cc6-bab8-11ed-afa1-0242ac120002",
           "epsilon_threshold": "1.5",
-          "noise_multiplier": "2.0",
-          "delta": "0.01",
-          "epochs_per_report": "2"
+          "delta": "0.01"
         },
         {
           "dataset": "2830a144-bab8-11ed-afa1-0242ac120002",
           "epsilon_threshold": "1.5",
-          "noise_multiplier": "2.0",
-          "delta": "0.01",
-          "epochs_per_report": "2"
+          "delta": "0.01"
         },
         {
           "dataset": "2a3b0c4e-bab8-11ed-afa1-0242ac120002",
           "epsilon_threshold": "1.5",
-          "noise_multiplier": "2.0",
-          "delta": "0.01",
-          "epochs_per_report": "2"
+          "delta": "0.01"
         }
       ]
     }
diff --git a/scenarios/brats/deployment/azure/0-create-acr.sh b/scenarios/brats/deployment/azure/0-create-acr.sh
index 71372dc..552e095 100755
--- a/scenarios/brats/deployment/azure/0-create-acr.sh
+++ b/scenarios/brats/deployment/azure/0-create-acr.sh
@@ -8,6 +8,15 @@ if [[ -z "$CONTAINER_REGISTRY" || -z "$AZURE_RESOURCE_GROUP" || -z "$AZURE_LOCAT
   exit 1
 fi
 
+# Remove .azurecr.io suffix if present (ACR names should not include the domain)
+CONTAINER_REGISTRY="${CONTAINER_REGISTRY%.azurecr.io}"
+
+# Validate ACR name: alphanumeric only, 5-50 characters
+if [[ ! "$CONTAINER_REGISTRY" =~ ^[a-zA-Z0-9]{5,50}$ ]]; then
+  echo "ERROR: Invalid ACR name '$CONTAINER_REGISTRY'. ACR names must be 5-50 alphanumeric characters only."
+  exit 1
+fi
+
 echo "Checking if ACR '$CONTAINER_REGISTRY' exists in resource group '$AZURE_RESOURCE_GROUP'..."
 
 # Check if ACR exists
@@ -18,22 +27,48 @@ if [[ -n "$ACR_EXISTS" ]]; then
 else
   echo "⏳ ACR '$CONTAINER_REGISTRY' does not exist. Creating..."
 
+  # Create ACR with premium SKU and admin enabled
   az acr create \
     --name "$CONTAINER_REGISTRY" \
     --resource-group "$AZURE_RESOURCE_GROUP" \
     --location "$AZURE_LOCATION" \
     --sku Premium \
     --admin-enabled true \
-    --anonymous-pull-enabled true \
     --output table
 
+  # Enable anonymous pull
+  az acr update --name "$CONTAINER_REGISTRY" --anonymous-pull-enabled true
+
   if [[ $? -eq 0 ]]; then
     echo "✅ ACR '$CONTAINER_REGISTRY' created successfully."
+    echo "⏳ Waiting for DNS propagation before login..."
+    sleep 10
   else
     echo "❌ Failed to create ACR."
     exit 1
   fi
 fi
 
-# Login to the ACR
-az acr login --name "$CONTAINER_REGISTRY"
\ No newline at end of file
+# Login to the ACR with retry mechanism (DNS propagation may take time)
+echo "Logging in to ACR '$CONTAINER_REGISTRY'..."
+MAX_RETRIES=15
+RETRY_DELAY=5
+RETRY_COUNT=0
+
+while [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; do
+  if az acr login --name "$CONTAINER_REGISTRY" 2>/dev/null; then
+    echo "✅ Successfully logged in to ACR '$CONTAINER_REGISTRY'."
+    exit 0
+  fi
+  
+  RETRY_COUNT=$((RETRY_COUNT + 1))
+  if [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; then
+    echo "⏳ Login attempt $RETRY_COUNT/$MAX_RETRIES failed. Retrying in ${RETRY_DELAY}s..."
+    sleep $RETRY_DELAY
+    RETRY_DELAY=$((RETRY_DELAY + 5))  # Exponential backoff
+  fi
+done
+
+echo "❌ Failed to login to ACR after $MAX_RETRIES attempts. DNS may still be propagating."
+echo "You can manually login later with: az acr login --name $CONTAINER_REGISTRY"
+exit 1
\ No newline at end of file
diff --git a/scenarios/brats/deployment/azure/1-create-storage-containers.sh b/scenarios/brats/deployment/azure/1-create-storage-containers.sh
index 4a30d09..c10bfd6 100755
--- a/scenarios/brats/deployment/azure/1-create-storage-containers.sh
+++ b/scenarios/brats/deployment/azure/1-create-storage-containers.sh
@@ -11,14 +11,20 @@ else
   echo "Resource group $AZURE_RESOURCE_GROUP already exists. Skipping creation."
 fi
 
-echo "Check if storage account $STORAGE_ACCOUNT_NAME exists..."
+echo "Check if storage account $AZURE_STORAGE_ACCOUNT_NAME exists..."
 STORAGE_ACCOUNT_EXISTS=$(az storage account check-name --name $AZURE_STORAGE_ACCOUNT_NAME --query "nameAvailable" --output tsv)
 
 if [ "$STORAGE_ACCOUNT_EXISTS" == "true" ]; then
   echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME does not exist. Creating it now..."
   az storage account create  --resource-group $AZURE_RESOURCE_GROUP  --name $AZURE_STORAGE_ACCOUNT_NAME
 else
-  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists. Skipping creation."
+  # Check if the storage account exists in the resource group
+  STORAGE_ACCOUNT_EXIST_IN_RG=$(az storage account show --name $AZURE_STORAGE_ACCOUNT_NAME --resource-group $AZURE_RESOURCE_GROUP --query "name" -o tsv 2>/dev/null)
+  if [ -z "$STORAGE_ACCOUNT_EXIST_IN_RG" ]; then
+    echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME is already reserved and does not exist in the $AZURE_RESOURCE_GROUP resource group. Please select a different name."
+    exit 1
+  fi
+  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists in the $AZURE_RESOURCE_GROUP resource group. Skipping creation."
 fi
 
 # Get the storage account key
diff --git a/scenarios/brats/deployment/azure/2-create-akv.sh b/scenarios/brats/deployment/azure/2-create-akv.sh
index 8a30dd5..3c4cfdc 100755
--- a/scenarios/brats/deployment/azure/2-create-akv.sh
+++ b/scenarios/brats/deployment/azure/2-create-akv.sh
@@ -5,14 +5,14 @@ set -e
 if [[ "$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then 
     AZURE_AKV_RESOURCE_NAME=`echo $AZURE_KEYVAULT_ENDPOINT | awk '{split($0,a,"."); print a[1]}'`
     # Check if the Key Vault already exists
-    echo "Checking if Key Vault $KEY_VAULT_NAME exists..."
+    echo "Checking if Key Vault $AZURE_AKV_RESOURCE_NAME exists..."
     NAME_AVAILABLE=$(az rest --method post \
-  	--uri "https://management.azure.com/subscriptions/$AZURE_SUBSCRIPTION_ID/providers/Microsoft.KeyVault/checkNameAvailability?api-version=2019-09-01" \
-  	--headers "Content-Type=application/json" \
-  	--body "{\"name\": \"$AZURE_AKV_RESOURCE_NAME\", \"type\": \"Microsoft.KeyVault/vaults\"}" | jq -r '.nameAvailable')
+        --uri "https://management.azure.com/subscriptions/$AZURE_SUBSCRIPTION_ID/providers/Microsoft.KeyVault/checkNameAvailability?api-version=2019-09-01" \
+        --headers "Content-Type=application/json" \
+        --body "{\"name\": \"$AZURE_AKV_RESOURCE_NAME\", \"type\": \"Microsoft.KeyVault/vaults\"}" | jq -r '.nameAvailable')
     if [ "$NAME_AVAILABLE" == true ]; then
-        echo "Key Vault $KEY_VAULT_NAME does not exist. Creating it now..."
-        echo CREATING $AZURE_KEYVAULT_ENDPOINT in resouce group $AZURE_RESOURCE_GROUP
+        echo "Key Vault $AZURE_AKV_RESOURCE_NAME does not exist. Creating it now..."
+        echo CREATING $AZURE_KEYVAULT_ENDPOINT in resource group $AZURE_RESOURCE_GROUP
         # Create Azure key vault with RBAC authorization
         az keyvault create --name $AZURE_AKV_RESOURCE_NAME --resource-group $AZURE_RESOURCE_GROUP --sku "Premium" --enable-rbac-authorization
         # Assign RBAC roles to the resource owner so they can import keys
@@ -20,7 +20,15 @@ if [[ "$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then
         az role assignment create --role "Key Vault Crypto Officer" --assignee `az account show --query user.name --output tsv` --scope $AKV_SCOPE
         az role assignment create --role "Key Vault Crypto User" --assignee `az account show --query user.name --output tsv` --scope $AKV_SCOPE
     else
-        echo "Key Vault $AZURE_AKV_RESOURCE_NAME already exists. Skipping creation."
+        # Name is not available — check if the vault exists in *this* subscription
+        if az keyvault show --name $AZURE_AKV_RESOURCE_NAME --resource-group $AZURE_RESOURCE_GROUP >/dev/null 2>&1; then
+            echo "Key Vault $AZURE_AKV_RESOURCE_NAME already exists in your subscription. Skipping creation."
+        else
+            echo "Key Vault name '$AZURE_AKV_RESOURCE_NAME' is already reserved."
+            echo "If you previously owned this Key Vault, it may be soft-deleted."
+            echo "Please purge the Key Vault before retrying."
+            exit 1
+        fi
     fi
 else
     echo "Automated creation of key vaults is supported only for vaults"
diff --git a/scenarios/brats/export-variables.sh b/scenarios/brats/export-variables.sh
index 7eeeff7..a5eae2e 100755
--- a/scenarios/brats/export-variables.sh
+++ b/scenarios/brats/export-variables.sh
@@ -30,7 +30,7 @@
 declare -x SCENARIO=brats
 declare -x REPO_ROOT="$(git rev-parse --show-toplevel)"
 declare -x CONTAINER_REGISTRY=ispirt.azurecr.io
-declare -x AZURE_LOCATION=centralindia
+declare -x AZURE_LOCATION=<azure-location>
 declare -x AZURE_SUBSCRIPTION_ID=
 declare -x AZURE_RESOURCE_GROUP=
 declare -x AZURE_KEYVAULT_ENDPOINT=
@@ -44,7 +44,7 @@ declare -x AZURE_MODEL_CONTAINER_NAME=modelcontainer
 declare -x AZURE_OUTPUT_CONTAINER_NAME=outputcontainer
 
 # For key import:
-declare -x CONTRACT_SERVICE_URL=https://depa-training-contract-service.centralindia.cloudapp.azure.com:8000
+declare -x CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
 declare -x TOOLS_HOME=$REPO_ROOT/external/confidential-sidecar-containers/tools
 
 # Export all variables to make them available to other scripts
diff --git a/scenarios/cifar10/.gitignore b/scenarios/cifar10/.gitignore
index 9d6d918..f6fd668 100644
--- a/scenarios/cifar10/.gitignore
+++ b/scenarios/cifar10/.gitignore
@@ -10,7 +10,7 @@
 *.hdf5
 
 # Ignore modeller output folder (relative to repo root)
-modeller/output/
+modeller/
 
 data/cifar*
 
diff --git a/scenarios/cifar10/README.md b/scenarios/cifar10/README.md
index e92b08f..f95bfbc 100644
--- a/scenarios/cifar10/README.md
+++ b/scenarios/cifar10/README.md
@@ -2,7 +2,7 @@
 
 ## Scenario Type
 
-| Scenario name | Scenario type | Task type | Privacy | No. of TDPs* | Data type (format) | Model type (format) | Join type (No. of datasets) | 
+| Scenario name | Scenario type | Task type | Privacy | No. of TDPs* | Data type (format) | Model type (format) | Join type (No. of datasets) |
 |--------------|---------------|-----------------|--------------|-----------|------------|------------|------------|
 | CIFAR-10 | Training - Deep Learning | Multi-class Image Classification | NA | 1 | Non-PII image data (SafeTensors) | CNN (Safetensors) | NA (1)|
 
@@ -12,14 +12,14 @@
 
 This scenario involves training a CNN for image classification using the CIFAR-10 image dataset. It involves one Training Data Provider (TDP), and a Training Data Consumer (TDC) who wishes to train a model on the dataset. The CIFAR-10 dataset is a collection of 60,000 32x32 color images in 10 classes (viz. airplanes, cars, birds, cats, deer, dogs, frogs, horses, ships, and trucks), with 6,000 images per class.
 
-The end-to-end training pipeline consists of the following phases. 
+The end-to-end training pipeline consists of the following phases.
 
 1. Data pre-processing
 2. Data packaging, encryption and upload
 3. Model packaging, encryption and upload
 4. Encryption key import with key release policies
 5. Deployment and execution of CCR
-6. Trained model decryption 
+6. Trained model decryption
 
 ## Build container images
 
@@ -32,12 +32,12 @@ cd $REPO_ROOT/scenarios/$SCENARIO
 ./ci/build.sh
 ```
 
-This script builds the following container images. 
+This script builds the following container images.
 
-- ```preprocess-cifar10```: Container for pre-processing CIFAR-10 dataset. 
-- ```cifar10-model-save```: Container that saves the model to be trained in PyTorch format. 
+- ```preprocess-cifar10```: Container for pre-processing CIFAR-10 dataset.
+- ```cifar10-model-save```: Container that saves the model to be trained in PyTorch format.
 
-Alternatively, you can pull and use pre-built container images from the ispirt container registry by setting the following environment variable. Docker hub has started throttling which may effect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
+Alternatively, you can pull and use pre-built container images from the iSPIRT container registry by setting the following environment variable. Docker hub has started throttling which may affect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
 
 ```bash
 export CONTAINER_REGISTRY=ispirt.azurecr.io
@@ -72,7 +72,7 @@ Assuming you have cleartext access to all the datasets, you can train the model
 ./train.sh
 ```
 
-The script joins the datasets and trains the model using a pipeline configuration. To modify the various components of the training pipeline, you can edit the training config files in the [config](./config/) directory. The training config files are used to create the pipeline configuration ([pipeline_config.json](./config/pipeline_config.json)) created by consolidating all the TDC's training config files, namely the [model config](./config/model_config.json), [dataset config](./config/dataset_config.json), [loss function config](./config/loss_config.json), [training config](./config/train_config_template.json), [evaluation config](./config/eval_config.json), and if multiple datasets are used, the [data join config](./config/join_config.json). These enable the TDC to design highly customized training pipelines without requiring review and approval of new custom code for each use case—reducing risks from potentially malicious or non-compliant code. The consolidated pipeline configuration is then attested against the signed contract using the TDP’s policy-as-code. If approved, it is executed in the CCR to train the model, which we will deploy in the next section.
+The script joins the datasets and trains the model using a pipeline configuration. To modify the various components of the training pipeline, you can edit the training config files in the [config](./config/) directory. The training config files are used to create the pipeline configuration ([pipeline_config.json](./config/pipeline_config.json)) created by consolidating all the TDC's training config files, namely the [model config](./config/model_config.json), [dataset config](./config/dataset_config.json), [loss function config](./config/loss_config.json), [training config](./config/train_config_template.json), [evaluation config](./config/eval_config.json), and if multiple datasets are used, the [data join config](./config/join_config.json). These enable the TDC to design highly customized training pipelines without requiring review and approval of new custom code for each use case — reducing risks from potentially malicious or non-compliant code. The consolidated pipeline configuration is then attested against the signed contract using the TDP's policy-as-code. If approved, it is executed in the CCR to train the model, which we will deploy in the next section.
 
 ```mermaid
 flowchart TD
@@ -111,35 +111,35 @@ train-1  | Dataset constructed from config
 train-1  | Custom model loaded from PyTorch config
 train-1  | Optimizer Adam loaded from config
 train-1  | Custom loss function loaded from config
-train-1  | Epoch 1/2 completed | Training Loss: 1.9266 
+train-1  | Epoch 1/2 completed | Training Loss: 1.9266
 train-1  | Epoch 1/2 completed | Validation Loss: 1.7594
-train-1  | Epoch 2/2 completed | Training Loss: 1.6811 
+train-1  | Epoch 2/2 completed | Training Loss: 1.6811
 train-1  | Epoch 2/2 completed | Validation Loss: 1.6222
 train-1  | Saving trained model to /mnt/remote/output/trained_model.pth
 train-1  | Evaluation Metrics: {'test_loss': 1.6260074046620152, 'accuracy': 0.4104707435107787, 'f1_score': 0.40647825713476216}
 train-1  | CCR Training complete!
-train-1  | 
+train-1  |
 train-1 exited with code 0
 ```
 
 ## Deploy on CCR
 
-In a more realistic scenario, this datasets will not be available in the clear to the TDC, and the TDC will be required to use a CCR for training. The following steps describe the process of sharing an encrypted dataset with TDCs and setting up a CCR in Azure for training. Please stay tuned for CCR on other cloud platforms. 
+In a more realistic scenario, these datasets will not be available in the clear to the TDC, and the TDC will be required to use a CCR for training. The following steps describe the process of sharing an encrypted dataset with TDCs and setting up a CCR in Azure for training. Please stay tuned for CCR on other cloud platforms.
 
-To deploy in Azure, you will need the following. 
+To deploy in Azure, you will need the following.
 
-- Docker Hub account to store container images. Alternatively, you can use pre-built images from the ```ispirt``` container registry. 
-- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) to store encryption keys and implement secure key release to CCR. You can either you Azure Key Vault Premium (lower cost), or [Azure Key Vault managed HSM](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) for enhanced security. Please see instructions below on how to create and setup your AKV instance. 
-- Valid Azure subscription with sufficient access to create key vault, storage accounts, storage containers, and Azure Container Instances (ACI). 
+- Docker Hub account to store container images. Alternatively, you can use pre-built images from the ```iSPIRT``` container registry.
+- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) to store encryption keys and implement secure key release to CCR. You can either use Azure Key Vault Premium (lower cost), or [Azure Key Vault managed HSM](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) for enhanced security. Please see instructions below on how to create and set up your AKV instance.
+- Valid Azure subscription with sufficient access to create key vault, storage accounts, storage containers, and Azure Container Instances (ACI).
 
-If you are using your own development environment instead of a dev container or codespaces, you will to install the following dependencies. 
+If you are using your own development environment instead of a dev container or codespaces, you will need to install the following dependencies.
 
 - [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux).  
 - [Azure CLI Confidential containers extension](https://learn.microsoft.com/en-us/cli/azure/confcom?view=azure-cli-latest). After installing Azure CLI, you can install this extension using ```az extension add --name confcom -y```
 - [Go](https://go.dev/doc/install). Follow the instructions to install Go. After installing, ensure that the PATH environment variable is set to include ```go``` runtime.
 - ```jq```. You can install jq using ```sudo apt-get install -y jq```
 
-We will be creating the following resources as part of the deployment. 
+We will be creating the following resources as part of the deployment.
 
 - Azure Key Vault
 - Azure Storage account
@@ -240,7 +240,7 @@ cd $REPO_ROOT/scenarios/$SCENARIO/deployment/azure
 
 ### 3\. Contract Signing
 
-Navigate to the [contract-ledger](https://github.com/kapilvgit/contract-ledger/blob/main/README.md) repository and follow the instructions for contract signing.
+Navigate to the [contract-service](https://github.com/iSPIRT/contract-service/blob/main/README.md) repository and follow the instructions for contract signing.
 
 Once the contract is signed, export the contract sequence number as an environment variable in the same terminal where you set the environment variables for the deployment.
 
@@ -252,14 +252,14 @@ export CONTRACT_SEQ_NO=<contract-sequence-number>
 
 ### 4\. Data Encryption and Upload
 
-Using their respective keys, the TDPs and TDC encrypt their datasets and model (respectively) and upload them to the Storage containers created in the previous step.
+Using their respective keys, the TDPs and TDC encrypt their datasets and models (respectively) and upload them to the Storage containers created in the previous step.
 
 Navigate to the [Azure deployment](./deployment/azure/) directory and execute the scripts for key import, data encryption and upload to Azure Blob Storage, in preparation of the CCR deployment.
 
-The import-keys script generates and imports encryption keys into Azure Key Vault with a policy based on [policy-in-template.json](./policy/policy-in-template.json). The policy requires that the CCRs run specific containers with a specific configuration which includes the public identity of the contract service. Only CCRs that satisfy this policy will be granted access to the encryption keys. The generated keys are available as files with the extension `.bin`. 
+The import-keys script generates and imports encryption keys into Azure Key Vault with a policy based on [policy-in-template.json](./policy/policy-in-template.json). The policy requires that the CCRs run specific containers with a specific configuration which includes the public identity of the contract service. Only CCRs that satisfy this policy will be granted access to the encryption keys. The generated keys are available as files with the extension `.bin`.
 
 ```bash
-export CONTRACT_SERVICE_URL=https://depa-training-contract-service.centralindia.cloudapp.azure.com:8000
+export CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
 export TOOLS_HOME=$REPO_ROOT/external/confidential-sidecar-containers/tools
 
 ./3-import-keys.sh
@@ -294,9 +294,7 @@ Set the `$CONTRACT_SEQ_NO` variable to the exact value of the contract sequence
 export CONTRACT_SEQ_NO=15
 ```
 
-This script will deploy the container images from your container registry, including the encrypted filesystem sidecar. The sidecar will generate an SEV-SNP attestation report, generate an attestation token using the Microsoft Azure Attestation (MAA) service, retrieve dataset, model and output encryption keys from the TDP and TDC's Azure Key Vault, train the model, and save the resulting model into TDC's output filesystem image, which the TDC can later decrypt. 
-
-<!-- **Note:** if the contract-ledger repository is also located at the root of the same environment where this depa-training repo is, the `$CONTRACT_SEQ_NO` variable automatically picks up the sequence number of the latest contract that was signed between the TDPs and TDC. -->
+This script will deploy the container images from your container registry, including the encrypted filesystem sidecar. The sidecar will generate an SEV-SNP attestation report, generate an attestation token using the Microsoft Azure Attestation (MAA) service, retrieve dataset, model and output encryption keys from the TDP and TDC's Azure Key Vault, train the model, and save the resulting model into TDC's output filesystem image, which the TDC can later decrypt.
 
 **Note:** The completion of this script's execution simply creates a CCR instance, and doesn't indicate whether training has completed or not. The training process might still be ongoing. Poll the container logs (see below) to track progress until training is complete.
 
@@ -344,7 +342,7 @@ cd mnt/remote && ls
 
 ### 6\. Download and Decrypt Model
 
-Once training has completed succesfully (The training container logs will mention it explicitly), download and decrypt the trained model and other training outputs.
+Once training has completed successfully (The training container logs will mention it explicitly), download and decrypt the trained model and other training outputs.
 
 ```bash
 ./6-download-decrypt-model.sh
@@ -355,7 +353,7 @@ The outputs will be saved to the [output](./modeller/output/) directory.
 To check if the trained model is fresh, you can run the following command:
 
 ```bash
-stat $REPO_ROOT/scenarios/$SCENARIO/modeller/output/trained_model.pth
+stat $REPO_ROOT/scenarios/$SCENARIO/modeller/output/trained_model.safetensors
 ```
 
 ---
diff --git a/scenarios/cifar10/config/pipeline_config.json b/scenarios/cifar10/config/pipeline_config.json
index 74f5f8b..1a39b3d 100644
--- a/scenarios/cifar10/config/pipeline_config.json
+++ b/scenarios/cifar10/config/pipeline_config.json
@@ -152,8 +152,9 @@
             "augment": false
           },
           "splits": {
-            "train": 0.8,
-            "val": 0.2,
+            "train": 0.85,
+            "val": 0.15,
+            "test": 0.05,
             "random_state": 42
           }
         },
diff --git a/scenarios/cifar10/config/train_config.json b/scenarios/cifar10/config/train_config.json
index f247681..2535cb0 100644
--- a/scenarios/cifar10/config/train_config.json
+++ b/scenarios/cifar10/config/train_config.json
@@ -150,8 +150,9 @@
         "augment": false
       },
       "splits": {
-        "train": 0.8,
-        "val": 0.2,
+        "train": 0.85,
+        "val": 0.15,
+        "test": 0.05,
         "random_state": 42
       }
     },
diff --git a/scenarios/cifar10/contract/contract.json b/scenarios/cifar10/contract/contract.json
index c59d85f..c563948 100644
--- a/scenarios/cifar10/contract/contract.json
+++ b/scenarios/cifar10/contract/contract.json
@@ -9,7 +9,8 @@
   "datasets": [
     {
       "id": "19517ba8-bab8-11ed-afa1-0242ac120002",
-      "name": "cifar10",
+      "owner": "cifar10",
+      "name": "cifar10-object-recognition",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_CIFAR10_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
diff --git a/scenarios/cifar10/deployment/azure/0-create-acr.sh b/scenarios/cifar10/deployment/azure/0-create-acr.sh
index fdd8103..552e095 100755
--- a/scenarios/cifar10/deployment/azure/0-create-acr.sh
+++ b/scenarios/cifar10/deployment/azure/0-create-acr.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Only to be run when creating a new Azure Container Registry (ACR).
+# Only to be run when creating a new ACR
 
 # Ensure required env vars are set
 if [[ -z "$CONTAINER_REGISTRY" || -z "$AZURE_RESOURCE_GROUP" || -z "$AZURE_LOCATION" ]]; then
@@ -8,6 +8,15 @@ if [[ -z "$CONTAINER_REGISTRY" || -z "$AZURE_RESOURCE_GROUP" || -z "$AZURE_LOCAT
   exit 1
 fi
 
+# Remove .azurecr.io suffix if present (ACR names should not include the domain)
+CONTAINER_REGISTRY="${CONTAINER_REGISTRY%.azurecr.io}"
+
+# Validate ACR name: alphanumeric only, 5-50 characters
+if [[ ! "$CONTAINER_REGISTRY" =~ ^[a-zA-Z0-9]{5,50}$ ]]; then
+  echo "ERROR: Invalid ACR name '$CONTAINER_REGISTRY'. ACR names must be 5-50 alphanumeric characters only."
+  exit 1
+fi
+
 echo "Checking if ACR '$CONTAINER_REGISTRY' exists in resource group '$AZURE_RESOURCE_GROUP'..."
 
 # Check if ACR exists
@@ -32,11 +41,34 @@ else
 
   if [[ $? -eq 0 ]]; then
     echo "✅ ACR '$CONTAINER_REGISTRY' created successfully."
+    echo "⏳ Waiting for DNS propagation before login..."
+    sleep 10
   else
     echo "❌ Failed to create ACR."
     exit 1
   fi
 fi
 
-# Login to the ACR
-az acr login --name "$CONTAINER_REGISTRY"
\ No newline at end of file
+# Login to the ACR with retry mechanism (DNS propagation may take time)
+echo "Logging in to ACR '$CONTAINER_REGISTRY'..."
+MAX_RETRIES=15
+RETRY_DELAY=5
+RETRY_COUNT=0
+
+while [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; do
+  if az acr login --name "$CONTAINER_REGISTRY" 2>/dev/null; then
+    echo "✅ Successfully logged in to ACR '$CONTAINER_REGISTRY'."
+    exit 0
+  fi
+  
+  RETRY_COUNT=$((RETRY_COUNT + 1))
+  if [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; then
+    echo "⏳ Login attempt $RETRY_COUNT/$MAX_RETRIES failed. Retrying in ${RETRY_DELAY}s..."
+    sleep $RETRY_DELAY
+    RETRY_DELAY=$((RETRY_DELAY + 5))  # Exponential backoff
+  fi
+done
+
+echo "❌ Failed to login to ACR after $MAX_RETRIES attempts. DNS may still be propagating."
+echo "You can manually login later with: az acr login --name $CONTAINER_REGISTRY"
+exit 1
\ No newline at end of file
diff --git a/scenarios/cifar10/deployment/azure/1-create-storage-containers.sh b/scenarios/cifar10/deployment/azure/1-create-storage-containers.sh
index da98b8a..abf8e34 100755
--- a/scenarios/cifar10/deployment/azure/1-create-storage-containers.sh
+++ b/scenarios/cifar10/deployment/azure/1-create-storage-containers.sh
@@ -18,7 +18,13 @@ if [ "$STORAGE_ACCOUNT_EXISTS" == "true" ]; then
   echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME does not exist. Creating it now..."
   az storage account create  --resource-group $AZURE_RESOURCE_GROUP  --name $AZURE_STORAGE_ACCOUNT_NAME
 else
-  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists. Skipping creation."
+  # Check if the storage account exists in the resource group
+  STORAGE_ACCOUNT_EXIST_IN_RG=$(az storage account show --name $AZURE_STORAGE_ACCOUNT_NAME --resource-group $AZURE_RESOURCE_GROUP --query "name" -o tsv 2>/dev/null)
+  if [ -z "$STORAGE_ACCOUNT_EXIST_IN_RG" ]; then
+    echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME is already reserved and does not exist in the $AZURE_RESOURCE_GROUP resource group. Please select a different name."
+    exit 1
+  fi
+  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists in the $AZURE_RESOURCE_GROUP resource group. Skipping creation."
 fi
 
 # Get the storage account key
diff --git a/scenarios/cifar10/deployment/azure/2-create-akv.sh b/scenarios/cifar10/deployment/azure/2-create-akv.sh
index c20a75e..3c4cfdc 100755
--- a/scenarios/cifar10/deployment/azure/2-create-akv.sh
+++ b/scenarios/cifar10/deployment/azure/2-create-akv.sh
@@ -12,7 +12,7 @@ if [[ "$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then
         --body "{\"name\": \"$AZURE_AKV_RESOURCE_NAME\", \"type\": \"Microsoft.KeyVault/vaults\"}" | jq -r '.nameAvailable')
     if [ "$NAME_AVAILABLE" == true ]; then
         echo "Key Vault $AZURE_AKV_RESOURCE_NAME does not exist. Creating it now..."
-        echo CREATING $AZURE_KEYVAULT_ENDPOINT in resouce group $AZURE_RESOURCE_GROUP
+        echo CREATING $AZURE_KEYVAULT_ENDPOINT in resource group $AZURE_RESOURCE_GROUP
         # Create Azure key vault with RBAC authorization
         az keyvault create --name $AZURE_AKV_RESOURCE_NAME --resource-group $AZURE_RESOURCE_GROUP --sku "Premium" --enable-rbac-authorization
         # Assign RBAC roles to the resource owner so they can import keys
@@ -20,7 +20,15 @@ if [[ "$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then
         az role assignment create --role "Key Vault Crypto Officer" --assignee `az account show --query user.name --output tsv` --scope $AKV_SCOPE
         az role assignment create --role "Key Vault Crypto User" --assignee `az account show --query user.name --output tsv` --scope $AKV_SCOPE
     else
-        echo "Key Vault $AZURE_AKV_RESOURCE_NAME already exists. Skipping creation."
+        # Name is not available — check if the vault exists in *this* subscription
+        if az keyvault show --name $AZURE_AKV_RESOURCE_NAME --resource-group $AZURE_RESOURCE_GROUP >/dev/null 2>&1; then
+            echo "Key Vault $AZURE_AKV_RESOURCE_NAME already exists in your subscription. Skipping creation."
+        else
+            echo "Key Vault name '$AZURE_AKV_RESOURCE_NAME' is already reserved."
+            echo "If you previously owned this Key Vault, it may be soft-deleted."
+            echo "Please purge the Key Vault before retrying."
+            exit 1
+        fi
     fi
 else
     echo "Automated creation of key vaults is supported only for vaults"
diff --git a/scenarios/cifar10/deployment/azure/5-upload-encrypted-data.sh b/scenarios/cifar10/deployment/azure/5-upload-encrypted-data.sh
index 440455a..f14c6c5 100755
--- a/scenarios/cifar10/deployment/azure/5-upload-encrypted-data.sh
+++ b/scenarios/cifar10/deployment/azure/5-upload-encrypted-data.sh
@@ -1,14 +1,14 @@
 #!/bin/bash
 
-export DATA_DIR=$REPO_ROOT/scenarios/$SCENARIO/data
-export MODEL_DIR=$REPO_ROOT/scenarios/$SCENARIO/modeller
+DATADIR=$REPO_ROOT/scenarios/$SCENARIO/data
+MODELDIR=$REPO_ROOT/scenarios/$SCENARIO/modeller
 
 ACCOUNT_KEY=$(az storage account keys list --account-name $AZURE_STORAGE_ACCOUNT_NAME --only-show-errors | jq -r .[0].value)
 
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_CIFAR10_CONTAINER_NAME \
-  --file $DATA_DIR/cifar10.img \
+  --file $DATADIR/cifar10.img \
   --name data.img \
   --type page \
   --overwrite \
@@ -17,7 +17,7 @@ az storage blob upload \
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_MODEL_CONTAINER_NAME \
-  --file $MODEL_DIR/model.img \
+  --file $MODELDIR/model.img \
   --name data.img \
   --type page \
   --overwrite \
@@ -26,7 +26,7 @@ az storage blob upload \
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_OUTPUT_CONTAINER_NAME \
-  --file $MODEL_DIR/output.img \
+  --file $MODELDIR/output.img \
   --name data.img \
   --type page \
   --overwrite \
diff --git a/scenarios/cifar10/export-variables.sh b/scenarios/cifar10/export-variables.sh
index 54b0936..cebb99b 100755
--- a/scenarios/cifar10/export-variables.sh
+++ b/scenarios/cifar10/export-variables.sh
@@ -30,7 +30,7 @@
 declare -x SCENARIO=cifar10
 declare -x REPO_ROOT="$(git rev-parse --show-toplevel)"
 declare -x CONTAINER_REGISTRY=ispirt.azurecr.io
-declare -x AZURE_LOCATION=centralindia
+declare -x AZURE_LOCATION=<azure-location>
 declare -x AZURE_SUBSCRIPTION_ID=
 declare -x AZURE_RESOURCE_GROUP=
 declare -x AZURE_KEYVAULT_ENDPOINT=
@@ -41,7 +41,7 @@ declare -x AZURE_MODEL_CONTAINER_NAME=modelcontainer
 declare -x AZURE_OUTPUT_CONTAINER_NAME=outputcontainer
 
 # For key import:
-declare -x CONTRACT_SERVICE_URL=https://depa-training-contract-service.centralindia.cloudapp.azure.com:8000
+declare -x CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
 declare -x TOOLS_HOME=$REPO_ROOT/external/confidential-sidecar-containers/tools
 
 # Export all variables to make them available to other scripts
diff --git a/scenarios/covid/.gitignore b/scenarios/covid/.gitignore
index 1f98b27..877031b 100644
--- a/scenarios/covid/.gitignore
+++ b/scenarios/covid/.gitignore
@@ -7,6 +7,6 @@
 *.npy
 
 # Ignore modeller output folder (relative to repo root)
-modeller/output/
+modeller/
 
 **/__pycache__/
\ No newline at end of file
diff --git a/scenarios/covid/README.md b/scenarios/covid/README.md
index 913d0fb..6c4fab3 100644
--- a/scenarios/covid/README.md
+++ b/scenarios/covid/README.md
@@ -1,8 +1,8 @@
-# COVID-19 Predictive Modelling 
+# COVID-19 Predictive Modelling
 
 ## Scenario Type
 
-| Scenario name | Scenario type | Task type | Privacy | No. of TDPs* | Data type (format) | Model type (format) | Join type (No. of datasets) | 
+| Scenario name | Scenario type | Task type | Privacy | No. of TDPs* | Data type (format) | Model type (format) | Join type (No. of datasets) |
 |--------------|---------------|-----------------|--------------|-----------|------------|------------|------------|
 | COVID-19 | Training - Deep Learning | Binary Classification | Differentially Private | 3 | PII tabular data (CSV) | MLP (ONNX) | Horizontal (3)|
 
@@ -16,10 +16,10 @@ The end-to-end training pipeline consists of the following phases:
 
 1. Data pre-processing and de-identification
 2. Data packaging, encryption and upload
-3. Model packaging, encryption and upload 
+3. Model packaging, encryption and upload
 4. Encryption key import with key release policies
 5. Deployment and execution of CCR
-6. Trained model decryption 
+6. Trained model decryption
 
 ## Build container images
 
@@ -34,10 +34,10 @@ cd $REPO_ROOT/scenarios/$SCENARIO
 
 This script builds the following container images:
 
-- ```preprocess-icmr, preprocess-cowin, preprocess-index```: Containers that pre-process and de-identify datasets. 
-- ```ccr-model-save```: Container that saves the model to be trained in ONNX format. 
+- ```preprocess-icmr, preprocess-cowin, preprocess-index```: Containers that pre-process and de-identify datasets.
+- ```ccr-model-save```: Container that saves the model to be trained in ONNX format.
 
-Alternatively, you can pull and use pre-built container images from the ispirt container registry by setting the following environment variable. Docker hub has started throttling which may effect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
+Alternatively, you can pull and use pre-built container images from the iSPIRT container registry by setting the following environment variable. Docker hub has started throttling which may affect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
 
 ```bash
 export CONTAINER_REGISTRY=ispirt.azurecr.io
@@ -72,7 +72,7 @@ Assuming you have cleartext access to all the de-identified datasets, you can tr
 ./train.sh
 ```
 
-The script joins the datasets and trains the model using a pipeline configuration. To modify the various components of the training pipeline, you can edit the training config files in the [config](./config/) directory. The training config files are used to create the pipeline configuration ([pipeline_config.json](./config/pipeline_config.json)) created by consolidating all the TDC's training config files, namely the [model config](./config/model_config.json), [dataset config](./config/dataset_config.json), [loss function config](./config/loss_config.json), [training config](./config/train_config_template.json), [evaluation config](./config/eval_config.json), and if multiple datasets are used, the [data join config](./config/join_config.json). These enable the TDC to design highly customized training pipelines without requiring review and approval of new custom code for each use case—reducing risks from potentially malicious or non-compliant code. The consolidated pipeline configuration is then attested against the signed contract using the TDP’s policy-as-code. If approved, it is executed in the CCR to train the model, which we will deploy in the next section.
+The script joins the datasets and trains the model using a pipeline configuration. To modify the various components of the training pipeline, you can edit the training config files in the [config](./config/) directory. The training config files are used to create the pipeline configuration ([pipeline_config.json](./config/pipeline_config.json)) created by consolidating all the TDC's training config files, namely the [model config](./config/model_config.json), [dataset config](./config/dataset_config.json), [loss function config](./config/loss_config.json), [training config](./config/train_config_template.json), [evaluation config](./config/eval_config.json), and if multiple datasets are used, the [data join config](./config/join_config.json). These enable the TDC to design highly customized training pipelines without requiring review and approval of new custom code for each use case — reducing risks from potentially malicious or non-compliant code. The consolidated pipeline configuration is then attested against the signed contract using the TDP's policy-as-code. If approved, it is executed in the CCR to train the model, which we will deploy in the next section.
 
 ```mermaid
 flowchart TD
@@ -138,7 +138,7 @@ train-1  | Non-private baseline model - Epoch 5/5 completed | Validation Loss: 0
 train-1  | Saving trained model to /mnt/remote/output/trained_model.onnx
 train-1  | Evaluation Metrics: {'test_loss': 0.6747791530951014, 'accuracy': 0.6415094339622641, 'f1_score': 0.5365853658536586, 'roc_auc': 0.6637159032424087}
 train-1  | CCR Training complete!
-train-1  | 
+train-1  |
 train-1 exited with code 0
 ```
 
@@ -148,22 +148,22 @@ Now that training has run successfully locally, let's move on to the actual exec
 
 ## Deploy on CCR
 
-In a more realistic scenario, these datasets will not be available in the clear to the TDC, and the TDC will be required to use a CCR for training her model. The following steps describe the process of sharing encrypted datasets with TDCs and setting up a CCR in Azure for training models. Please stay tuned for CCR on other cloud platforms. 
+In a more realistic scenario, these datasets will not be available in the clear to the TDC, and the TDC will be required to use a CCR for training her model. The following steps describe the process of sharing encrypted datasets with TDCs and setting up a CCR in Azure for training models. Please stay tuned for CCR on other cloud platforms.
 
-To deploy in Azure, you will need the following. 
+To deploy in Azure, you will need the following.
 
-- Docker Hub account to store container images. Alternatively, you can use pre-built images from the ```ispirt``` container registry. 
-- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) to store encryption keys and implement secure key release to CCR. You can either you Azure Key Vault Premium (lower cost), or [Azure Key Vault managed HSM](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) for enhanced security. Please see instructions below on how to create and setup your AKV instance. 
-- Valid Azure subscription with sufficient access to create key vault, storage accounts, storage containers, and Azure Container Instances (ACI). 
+- Docker Hub account to store container images. Alternatively, you can use pre-built images from the ```iSPIRT``` container registry.
+- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) to store encryption keys and implement secure key release to CCR. You can either use Azure Key Vault Premium (lower cost), or [Azure Key Vault managed HSM](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) for enhanced security. Please see instructions below on how to create and set up your AKV instance.
+- Valid Azure subscription with sufficient access to create key vault, storage accounts, storage containers, and Azure Container Instances (ACI).
 
-If you are using your own development environment instead of a dev container or codespaces, you will to install the following dependencies. 
+If you are using your own development environment instead of a dev container or codespaces, you will need to install the following dependencies.
 
 - [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux).  
 - [Azure CLI Confidential containers extension](https://learn.microsoft.com/en-us/cli/azure/confcom?view=azure-cli-latest). After installing Azure CLI, you can install this extension using ```az extension add --name confcom -y```
 - [Go](https://go.dev/doc/install). Follow the instructions to install Go. After installing, ensure that the PATH environment variable is set to include ```go``` runtime.
 - ```jq```. You can install jq using ```sudo apt-get install -y jq```
 
-We will be creating the following resources as part of the deployment. 
+We will be creating the following resources as part of the deployment.
 
 - Azure Key Vault
 - Azure Storage account
@@ -274,7 +274,7 @@ cd $REPO_ROOT/scenarios/$SCENARIO/deployment/azure
 
 ### 3\. Contract Signing
 
-Navigate to the [contract-ledger](https://github.com/kapilvgit/contract-ledger/blob/main/README.md) repository and follow the instructions for contract signing.
+Navigate to the [contract-service](https://github.com/iSPIRT/contract-service/blob/main/README.md) repository and follow the instructions for contract signing.
 
 Once the contract is signed, export the contract sequence number as an environment variable in the same terminal where you set the environment variables for the deployment.
 
@@ -286,14 +286,14 @@ export CONTRACT_SEQ_NO=<contract-sequence-number>
 
 ### 4\. Data Encryption and Upload
 
-Using their respective keys, the TDPs and TDC encrypt their datasets and model (respectively) and upload them to the Storage containers created in the previous step.
+Using their respective keys, the TDPs and TDC encrypt their datasets and models (respectively) and upload them to the Storage containers created in the previous step.
 
 Navigate to the [Azure deployment](./deployment/azure/) directory and execute the scripts for key import, data encryption and upload to Azure Blob Storage, in preparation of the CCR deployment.
 
-The import-keys script generates and imports encryption keys into Azure Key Vault with a policy based on [policy-in-template.json](./policy/policy-in-template.json). The policy requires that the CCRs run specific containers with a specific configuration which includes the public identity of the contract service. Only CCRs that satisfy this policy will be granted access to the encryption keys. The generated keys are available as files with the extension `.bin`. 
+The import-keys script generates and imports encryption keys into Azure Key Vault with a policy based on [policy-in-template.json](./policy/policy-in-template.json). The policy requires that the CCRs run specific containers with a specific configuration which includes the public identity of the contract service. Only CCRs that satisfy this policy will be granted access to the encryption keys. The generated keys are available as files with the extension `.bin`.
 
 ```bash
-export CONTRACT_SERVICE_URL=https://depa-training-contract-service.centralindia.cloudapp.azure.com:8000
+export CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
 export TOOLS_HOME=$REPO_ROOT/external/confidential-sidecar-containers/tools
 
 ./3-import-keys.sh
@@ -328,9 +328,7 @@ Set the `$CONTRACT_SEQ_NO` variable to the exact value of the contract sequence
 export CONTRACT_SEQ_NO=15
 ```
 
-This script will deploy the container images from your container registry, including the encrypted filesystem sidecar. The sidecar will generate an SEV-SNP attestation report, generate an attestation token using the Microsoft Azure Attestation (MAA) service, retrieve dataset, model and output encryption keys from the TDP and TDC's Azure Key Vault, train the model, and save the resulting model into TDC's output filesystem image, which the TDC can later decrypt. 
-
-<!-- **Note:** if the contract-ledger repository is also located at the root of the same environment where this depa-training repo is, the `$CONTRACT_SEQ_NO` variable automatically picks up the sequence number of the latest contract that was signed between the TDPs and TDC. -->
+This script will deploy the container images from your container registry, including the encrypted filesystem sidecar. The sidecar will generate an SEV-SNP attestation report, generate an attestation token using the Microsoft Azure Attestation (MAA) service, retrieve dataset, model and output encryption keys from the TDP and TDC's Azure Key Vault, train the model, and save the resulting model into TDC's output filesystem image, which the TDC can later decrypt.
 
 **Note:** The completion of this script's execution simply creates a CCR instance, and doesn't indicate whether training has completed or not. The training process might still be ongoing. Poll the container logs (see below) to track progress until training is complete.
 
@@ -378,7 +376,7 @@ cd mnt/remote && ls
 
 ### 6\. Download and Decrypt Model
 
-Once training has completed succesfully (The training container logs will mention it explicitly), download and decrypt the trained model and other training outputs.
+Once training has completed successfully (The training container logs will mention it explicitly), download and decrypt the trained model and other training outputs.
 
 ```bash
 ./6-download-decrypt-model.sh
@@ -395,8 +393,6 @@ stat $REPO_ROOT/scenarios/$SCENARIO/modeller/output/trained_model.onnx
 ---
 ### Clean-up
 
-
-
 You can use the following command to delete the resource group and clean-up all resources used in the demo. Alternatively, you can navigate to the Azure portal and delete the resource group created for this demo.
 
 ```bash
diff --git a/scenarios/covid/ci/Dockerfile.modelsave b/scenarios/covid/ci/Dockerfile.modelsave
index de8ba5c..88469a0 100644
--- a/scenarios/covid/ci/Dockerfile.modelsave
+++ b/scenarios/covid/ci/Dockerfile.modelsave
@@ -12,6 +12,6 @@ RUN python3 get-pip.py
 
 ## Install dependencies
 RUN pip3 install torch --index-url https://download.pytorch.org/whl/cpu
-RUN pip3 --default-timeout=1000 install pandas onnx scikit-learn scipy matplotlib
+RUN pip3 --default-timeout=1000 install pandas onnx onnxscript scikit-learn scipy matplotlib
 
 COPY save_base_model.py save_base_model.py
diff --git a/scenarios/covid/config/sample_variants/model_config_xgboost.json b/scenarios/covid/config/sample_variants/model_config_xgboost.json
index 6ac75b1..8f50f67 100644
--- a/scenarios/covid/config/sample_variants/model_config_xgboost.json
+++ b/scenarios/covid/config/sample_variants/model_config_xgboost.json
@@ -1,8 +1,8 @@
 {
-    "num_boost_round": 100,
-    "booster_params": {
-        "max_depth": 6,
-        "learning_rate": 0.1,
-        "objective": "binary:logistic"
-    }
+    "n_estimators": 250,
+    "max_depth": 6,
+    "learning_rate": 0.05,
+    "l2_regularization": 1.0,
+    "min_child_weight": 1.0,
+    "objective": "binary:logistic"
 }
\ No newline at end of file
diff --git a/scenarios/covid/contract/contract.json b/scenarios/covid/contract/contract.json
index 85820c0..f2a5015 100644
--- a/scenarios/covid/contract/contract.json
+++ b/scenarios/covid/contract/contract.json
@@ -9,7 +9,8 @@
   "datasets": [
     {
       "id": "19517ba8-bab8-11ed-afa1-0242ac120002",
-      "name": "icmr",
+      "owner": "icmr",
+      "name": "icmr_test_results",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_ICMR_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -25,7 +26,8 @@
     },
     {
       "id": "216d5cc6-bab8-11ed-afa1-0242ac120002",
-      "name": "cowin",
+      "owner": "cowin",
+      "name": "cowin_vaccine_data",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_COWIN_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -41,7 +43,8 @@
     },
     {
       "id": "2830a144-bab8-11ed-afa1-0242ac120002",
-      "name": "index",
+      "owner": "index",
+      "name": "index_patient_records",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_INDEX_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
diff --git a/scenarios/covid/deployment/azure/0-create-acr.sh b/scenarios/covid/deployment/azure/0-create-acr.sh
index 4719bad..552e095 100755
--- a/scenarios/covid/deployment/azure/0-create-acr.sh
+++ b/scenarios/covid/deployment/azure/0-create-acr.sh
@@ -8,6 +8,15 @@ if [[ -z "$CONTAINER_REGISTRY" || -z "$AZURE_RESOURCE_GROUP" || -z "$AZURE_LOCAT
   exit 1
 fi
 
+# Remove .azurecr.io suffix if present (ACR names should not include the domain)
+CONTAINER_REGISTRY="${CONTAINER_REGISTRY%.azurecr.io}"
+
+# Validate ACR name: alphanumeric only, 5-50 characters
+if [[ ! "$CONTAINER_REGISTRY" =~ ^[a-zA-Z0-9]{5,50}$ ]]; then
+  echo "ERROR: Invalid ACR name '$CONTAINER_REGISTRY'. ACR names must be 5-50 alphanumeric characters only."
+  exit 1
+fi
+
 echo "Checking if ACR '$CONTAINER_REGISTRY' exists in resource group '$AZURE_RESOURCE_GROUP'..."
 
 # Check if ACR exists
@@ -32,11 +41,34 @@ else
 
   if [[ $? -eq 0 ]]; then
     echo "✅ ACR '$CONTAINER_REGISTRY' created successfully."
+    echo "⏳ Waiting for DNS propagation before login..."
+    sleep 10
   else
     echo "❌ Failed to create ACR."
     exit 1
   fi
 fi
 
-# Login to the ACR
-az acr login --name "$CONTAINER_REGISTRY"
\ No newline at end of file
+# Login to the ACR with retry mechanism (DNS propagation may take time)
+echo "Logging in to ACR '$CONTAINER_REGISTRY'..."
+MAX_RETRIES=15
+RETRY_DELAY=5
+RETRY_COUNT=0
+
+while [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; do
+  if az acr login --name "$CONTAINER_REGISTRY" 2>/dev/null; then
+    echo "✅ Successfully logged in to ACR '$CONTAINER_REGISTRY'."
+    exit 0
+  fi
+  
+  RETRY_COUNT=$((RETRY_COUNT + 1))
+  if [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; then
+    echo "⏳ Login attempt $RETRY_COUNT/$MAX_RETRIES failed. Retrying in ${RETRY_DELAY}s..."
+    sleep $RETRY_DELAY
+    RETRY_DELAY=$((RETRY_DELAY + 5))  # Exponential backoff
+  fi
+done
+
+echo "❌ Failed to login to ACR after $MAX_RETRIES attempts. DNS may still be propagating."
+echo "You can manually login later with: az acr login --name $CONTAINER_REGISTRY"
+exit 1
\ No newline at end of file
diff --git a/scenarios/covid/deployment/azure/1-create-storage-containers.sh b/scenarios/covid/deployment/azure/1-create-storage-containers.sh
index dbab27f..de7e127 100755
--- a/scenarios/covid/deployment/azure/1-create-storage-containers.sh
+++ b/scenarios/covid/deployment/azure/1-create-storage-containers.sh
@@ -11,14 +11,20 @@ else
   echo "Resource group $AZURE_RESOURCE_GROUP already exists. Skipping creation."
 fi
 
-echo "Check if storage account $STORAGE_ACCOUNT_NAME exists..."
+echo "Check if storage account $AZURE_STORAGE_ACCOUNT_NAME exists..."
 STORAGE_ACCOUNT_EXISTS=$(az storage account check-name --name $AZURE_STORAGE_ACCOUNT_NAME --query "nameAvailable" --output tsv)
 
 if [ "$STORAGE_ACCOUNT_EXISTS" == "true" ]; then
   echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME does not exist. Creating it now..."
   az storage account create  --resource-group $AZURE_RESOURCE_GROUP  --name $AZURE_STORAGE_ACCOUNT_NAME
 else
-  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists. Skipping creation."
+  # Check if the storage account exists in the resource group
+  STORAGE_ACCOUNT_EXIST_IN_RG=$(az storage account show --name $AZURE_STORAGE_ACCOUNT_NAME --resource-group $AZURE_RESOURCE_GROUP --query "name" -o tsv 2>/dev/null)
+  if [ -z "$STORAGE_ACCOUNT_EXIST_IN_RG" ]; then
+    echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME is already reserved and does not exist in the $AZURE_RESOURCE_GROUP resource group. Please select a different name."
+    exit 1
+  fi
+  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists in the $AZURE_RESOURCE_GROUP resource group. Skipping creation."
 fi
 
 # Get the storage account key
diff --git a/scenarios/covid/deployment/azure/2-create-akv.sh b/scenarios/covid/deployment/azure/2-create-akv.sh
index 545b08b..3c4cfdc 100755
--- a/scenarios/covid/deployment/azure/2-create-akv.sh
+++ b/scenarios/covid/deployment/azure/2-create-akv.sh
@@ -1,18 +1,18 @@
 #!/bin/bash
 
 set -e 
-  
+
 if [[ "$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then 
     AZURE_AKV_RESOURCE_NAME=`echo $AZURE_KEYVAULT_ENDPOINT | awk '{split($0,a,"."); print a[1]}'`
     # Check if the Key Vault already exists
-    echo "Checking if Key Vault $KEY_VAULT_NAME exists..."
+    echo "Checking if Key Vault $AZURE_AKV_RESOURCE_NAME exists..."
     NAME_AVAILABLE=$(az rest --method post \
-  	--uri "https://management.azure.com/subscriptions/$AZURE_SUBSCRIPTION_ID/providers/Microsoft.KeyVault/checkNameAvailability?api-version=2019-09-01" \
-  	--headers "Content-Type=application/json" \
-  	--body "{\"name\": \"$AZURE_AKV_RESOURCE_NAME\", \"type\": \"Microsoft.KeyVault/vaults\"}" | jq -r '.nameAvailable')
+        --uri "https://management.azure.com/subscriptions/$AZURE_SUBSCRIPTION_ID/providers/Microsoft.KeyVault/checkNameAvailability?api-version=2019-09-01" \
+        --headers "Content-Type=application/json" \
+        --body "{\"name\": \"$AZURE_AKV_RESOURCE_NAME\", \"type\": \"Microsoft.KeyVault/vaults\"}" | jq -r '.nameAvailable')
     if [ "$NAME_AVAILABLE" == true ]; then
-        echo "Key Vault $KEY_VAULT_NAME does not exist. Creating it now..."
-        echo CREATING $AZURE_KEYVAULT_ENDPOINT in resouce group $AZURE_RESOURCE_GROUP
+        echo "Key Vault $AZURE_AKV_RESOURCE_NAME does not exist. Creating it now..."
+        echo CREATING $AZURE_KEYVAULT_ENDPOINT in resource group $AZURE_RESOURCE_GROUP
         # Create Azure key vault with RBAC authorization
         az keyvault create --name $AZURE_AKV_RESOURCE_NAME --resource-group $AZURE_RESOURCE_GROUP --sku "Premium" --enable-rbac-authorization
         # Assign RBAC roles to the resource owner so they can import keys
@@ -20,7 +20,15 @@ if [[ "$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then
         az role assignment create --role "Key Vault Crypto Officer" --assignee `az account show --query user.name --output tsv` --scope $AKV_SCOPE
         az role assignment create --role "Key Vault Crypto User" --assignee `az account show --query user.name --output tsv` --scope $AKV_SCOPE
     else
-	echo "Key Vault $AZURE_KEYVAULT_ENDPOINT exists"
+        # Name is not available — check if the vault exists in *this* subscription
+        if az keyvault show --name $AZURE_AKV_RESOURCE_NAME --resource-group $AZURE_RESOURCE_GROUP >/dev/null 2>&1; then
+            echo "Key Vault $AZURE_AKV_RESOURCE_NAME already exists in your subscription. Skipping creation."
+        else
+            echo "Key Vault name '$AZURE_AKV_RESOURCE_NAME' is already reserved."
+            echo "If you previously owned this Key Vault, it may be soft-deleted."
+            echo "Please purge the Key Vault before retrying."
+            exit 1
+        fi
     fi
 else
     echo "Automated creation of key vaults is supported only for vaults"
diff --git a/scenarios/covid/export-variables.sh b/scenarios/covid/export-variables.sh
index da94633..66e5d4d 100755
--- a/scenarios/covid/export-variables.sh
+++ b/scenarios/covid/export-variables.sh
@@ -30,7 +30,7 @@
 declare -x SCENARIO=covid
 declare -x REPO_ROOT="$(git rev-parse --show-toplevel)"
 declare -x CONTAINER_REGISTRY=ispirt.azurecr.io
-declare -x AZURE_LOCATION=centralindia
+declare -x AZURE_LOCATION=<azure-location>
 declare -x AZURE_SUBSCRIPTION_ID=
 declare -x AZURE_RESOURCE_GROUP=
 declare -x AZURE_KEYVAULT_ENDPOINT=
@@ -43,7 +43,7 @@ declare -x AZURE_MODEL_CONTAINER_NAME=modelcontainer
 declare -x AZURE_OUTPUT_CONTAINER_NAME=outputcontainer
 
 # For key import:
-declare -x CONTRACT_SERVICE_URL=https://depa-training-contract-service.centralindia.cloudapp.azure.com:8000
+declare -x CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
 declare -x TOOLS_HOME=$REPO_ROOT/external/confidential-sidecar-containers/tools
 
 # Export all variables to make them available to other scripts
diff --git a/scenarios/covid/src/save_base_model.py b/scenarios/covid/src/save_base_model.py
index b5f96db..e144921 100644
--- a/scenarios/covid/src/save_base_model.py
+++ b/scenarios/covid/src/save_base_model.py
@@ -143,9 +143,20 @@ def main():
 
     print('Training finished.')
 
-    # Save model
-    torch.onnx.export(model, torch.randn(1, train_features.shape[1]), 
-                     "/mnt/model/model.onnx", verbose=True)
+    # Save model using legacy ONNX exporter for compatibility
+    with torch.no_grad():
+        torch.onnx.export(
+            model, 
+            torch.randn(1, train_features.shape[1]), 
+            "/mnt/model/model.onnx",
+            export_params=True,
+            opset_version=11,
+            do_constant_folding=True,
+            input_names=['input'],
+            output_names=['output'],
+            verbose=False,
+            dynamo=False  # Use legacy exporter, not the new dynamo-based one
+        )
     print('Model saved as ONNX.')
 
 
diff --git a/scenarios/credit-risk/.gitignore b/scenarios/credit-risk/.gitignore
index db1ef7f..76406da 100644
--- a/scenarios/credit-risk/.gitignore
+++ b/scenarios/credit-risk/.gitignore
@@ -10,7 +10,7 @@
 *.gz
 
 # Ignore modeller output folder (relative to repo root)
-modeller/output/
+modeller/
 
 data/
 
diff --git a/scenarios/credit-risk/README.md b/scenarios/credit-risk/README.md
index a9d9772..c3b086a 100644
--- a/scenarios/credit-risk/README.md
+++ b/scenarios/credit-risk/README.md
@@ -2,27 +2,27 @@
 
 ## Scenario Type
 
-| Scenario name | Scenario type | Task type | Privacy | No. of TDPs* | Data type (format) | Model type (format) | Join type (No. of datasets) | 
+| Scenario name | Scenario type | Task type | Privacy | No. of TDPs* | Data type (format) | Model type (format) | Join type (No. of datasets) |
 |--------------|---------------|-----------------|--------------|-----------|------------|------------|------------|
-| Credit Risk | Training - Classical ML | Binary Classification | Differentially Private | 4 | PII tabular data (Parquet) | XGBoost (JSON) | Horizontal (4)|
+| Credit Risk | Training - Classical ML | Binary Classification | Differentially Private | 4 | PII tabular data (Parquet) | XGBoost (JSON) | Horizontal (6)|
 
 ---
 
 ## Scenario Description
 
-This scenario involves training an XGBoost model on the [Home Credit Default Risk](https://www.kaggle.com/c/home-credit-default-risk) datasets [[1, 2]](README.md#references). We frame this scenario as involving four Training Data Providers (TDPs) - Bank A providing data for clients' credit applications, previous applications and payment installments, Bank B providing data on credit card balance, the Credit Bureau providing data on previous loans, and a Fintech providing data on point of sale (POS) cash balance. Here, Bank A is also the Training Data Consumer (TDC) who wishes to train the model on the joined datasets, in order to build a default risk prediction model.
+This scenario involves training an **XGBoost** model on the [Home Credit Default Risk](https://www.kaggle.com/c/home-credit-default-risk) datasets [[1, 2]](README.md#references). We frame this scenario as involving four Training Data Providers (TDPs) - **Bank A** providing data for clients' (i) credit applications, (ii) previous applications and (iii) payment installments, **Bank B** providing data on (i) credit card balance, the **Credit Bureau** providing data on (i) previous loans, and a **Fintech** providing data on (i) point of sale (POS) cash balance. Here, **Bank A** is also the Training Data Consumer (TDC) who wishes to train the model on the joined datasets, in order to build a default risk prediction model.
 
-The end-to-end training pipeline consists of the following phases: 
+The end-to-end training pipeline consists of the following phases:
 
 1. Data pre-processing
 2. Data packaging, encryption and upload
 3. Encryption key import with key release policies
 4. Deployment and execution of CCR
-5. Trained model decryption 
+5. Trained model decryption
 
 ## Build container images
 
-Build container images required for this sample as follows. 
+Build container images required for this sample as follows.
 
 ```bash
 export SCENARIO=credit-risk
@@ -31,14 +31,14 @@ cd $REPO_ROOT/scenarios/$SCENARIO
 ./ci/build.sh
 ```
 
-This script builds the following container images. 
+This script builds the following container images.
 
-- ```preprocess-bank-a```: Container for pre-processing Bank A's dataset. 
-- ```preprocess-bank-b```: Container for pre-processing Bank B's dataset. 
-- ```preprocess-bureau```: Container for pre-processing Bureau's dataset. 
+- ```preprocess-bank-a```: Container for pre-processing Bank A's dataset.
+- ```preprocess-bank-b```: Container for pre-processing Bank B's dataset.
+- ```preprocess-bureau```: Container for pre-processing Bureau's dataset.
 - ```preprocess-fintech```: Container for pre-processing Fintech's dataset.
 
-Alternatively, you can pull and use pre-built container images from the ispirt container registry by setting the following environment variable. Docker hub has started throttling which may effect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
+Alternatively, you can pull and use pre-built container images from the iSPIRT container registry by setting the following environment variable. Docker hub has started throttling which may affect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
 
 ```bash
 export CONTAINER_REGISTRY=ispirt.azurecr.io
@@ -50,7 +50,7 @@ cd $REPO_ROOT/scenarios/$SCENARIO
 
 The folder ```scenarios/credit-risk/src``` contains scripts for downloading and pre-processing the datasets. Acting as a Training Data Provider (TDP), prepare your datasets.
 
-Since these datasets are downloaded from [Kaggle.com](https://kaggle.com), set your Kaggle credentials as environment variables before running the preprocess script. The Kaggle credentials can be obtained from your Kaggle account settings > API > Create new token.
+Since these datasets are downloaded from [Kaggle.com](https://kaggle.com), set your Kaggle credentials as environment variables before running the preprocess scripts. The Kaggle credentials can be obtained from your Kaggle account settings > API > Create new token.
 
 ```bash
 export KAGGLE_USERNAME=<kaggle-username>
@@ -74,7 +74,7 @@ Assuming you have cleartext access to all the datasets, you can train the model
 ./train.sh
 ```
 
-The script joins the datasets and trains the model using a pipeline configuration. To modify the various components of the training pipeline, you can edit the training config files in the [config](./config/) directory. The training config files are used to create the pipeline configuration ([pipeline_config.json](./config/pipeline_config.json)) created by consolidating all the TDC's training config files, namely the [model config](./config/model_config.json), [dataset config](./config/dataset_config.json), [loss function config](./config/loss_config.json), [training config](./config/train_config_template.json), [evaluation config](./config/eval_config.json), and if multiple datasets are used, the [data join config](./config/join_config.json). These enable the TDC to design highly customized training pipelines without requiring review and approval of new custom code for each use case—reducing risks from potentially malicious or non-compliant code. The consolidated pipeline configuration is then attested against the signed contract using the TDP’s policy-as-code. If approved, it is executed in the CCR to train the model, which we will deploy in the next section.
+The script joins the datasets and trains the model using a pipeline configuration. To modify the various components of the training pipeline, you can edit the training config files in the [config](./config/) directory. The training config files are used to create the pipeline configuration ([pipeline_config.json](./config/pipeline_config.json)) created by consolidating all the TDC's training config files, namely the [model config](./config/model_config.json), [dataset config](./config/dataset_config.json), [loss function config](./config/loss_config.json), [training config](./config/train_config_template.json), [evaluation config](./config/eval_config.json), and if multiple datasets are used, the [data join config](./config/join_config.json). These enable the TDC to design highly customized training pipelines without requiring review and approval of new custom code for each use case — reducing risks from potentially malicious or non-compliant code. The consolidated pipeline configuration is then attested against the signed contract using the TDP's policy-as-code. If approved, it is executed in the CCR to train the model, which we will deploy in the next section.
 
 ```mermaid
 flowchart TD
@@ -106,41 +106,35 @@ flowchart TD
 If all goes well, you should see output similar to the following output, and the trained model and evaluation metrics will be saved under the folder [output](./modeller/output).
 
 ```
-train-1  | Training samples: 43636
-train-1  | Validation samples: 10909
-train-1  | Test samples: 5455
-train-1  | Dataset constructed from config
-train-1  | Model loaded from ONNX file
-train-1  | Optimizer Adam loaded from config
-train-1  | Scheduler CyclicLR loaded from config
-train-1  | Custom loss function loaded from config
-train-1  | Epoch 1/1 completed | Training Loss: 0.1586 
-train-1  | Epoch 1/1 completed | Validation Loss: 0.0860
-train-1  | Saving trained model to /mnt/remote/output/trained_model.onnx
-train-1  | Evaluation Metrics: {'test_loss': 0.08991911436687393, 'accuracy': 0.9523373052245646, 'f1_score': 0.9522986646537908}
+train-1  | Joined datasets: ['credit_applications', 'previous_applications', 'payment_installments', 'bureau_records', 'pos_cash_balance', 'credit_card_balance']
+train-1  | Loaded dataset splits | train: (6038, 63) | val: (755, 63) | test: (755, 63)
+train-1  | Trained Gradient Boosting model with 250 boosting rounds | Epsilon: 4.0
+train-1  | Saved model to /mnt/remote/output
+train-1  | Evaluation Metrics: {'accuracy': 0.5231788079470199, 'roc_auc': 0.47444826338639656}
+train-1  | Non-DP Evaluation Metrics: {'accuracy': 0.9152317880794701, 'roc_auc': 0.6496472503617945}
 train-1  | CCR Training complete!
-train-1  | 
+train-1  |
 train-1 exited with code 0
 ```
 
 ## Deploy on CCR
 
-In a more realistic scenario, this datasets will not be available in the clear to the TDC, and the TDC will be required to use a CCR for training. The following steps describe the process of sharing an encrypted dataset with TDCs and setting up a CCR in Azure for training. Please stay tuned for CCR on other cloud platforms. 
+In a more realistic scenario, these datasets will not be available in the clear to the TDC, and the TDC will be required to use a CCR for training her model. The following steps describe the process of sharing encrypted datasets with TDCs and setting up a CCR in Azure for training. Please stay tuned for CCR on other cloud platforms.
 
-To deploy in Azure, you will need the following. 
+To deploy in Azure, you will need the following.
 
-- Docker Hub account to store container images. Alternatively, you can use pre-built images from the ```ispirt``` container registry. 
-- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) to store encryption keys and implement secure key release to CCR. You can either you Azure Key Vault Premium (lower cost), or [Azure Key Vault managed HSM](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) for enhanced security. Please see instructions below on how to create and setup your AKV instance. 
-- Valid Azure subscription with sufficient access to create key vault, storage accounts, storage containers, and Azure Container Instances (ACI). 
+- Docker Hub account to store container images. Alternatively, you can use pre-built images from the ```iSPIRT``` container registry.
+- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) to store encryption keys and implement secure key release to CCR. You can either use Azure Key Vault Premium (lower cost), or [Azure Key Vault managed HSM](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) for enhanced security. Please see instructions below on how to create and set up your AKV instance.
+- Valid Azure subscription with sufficient access to create key vault, storage accounts, storage containers, and Azure Container Instances (ACI).
 
-If you are using your own development environment instead of a dev container or codespaces, you will to install the following dependencies. 
+If you are using your own development environment instead of a dev container or codespaces, you will need to install the following dependencies.
 
 - [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux).  
 - [Azure CLI Confidential containers extension](https://learn.microsoft.com/en-us/cli/azure/confcom?view=azure-cli-latest). After installing Azure CLI, you can install this extension using ```az extension add --name confcom -y```
 - [Go](https://go.dev/doc/install). Follow the instructions to install Go. After installing, ensure that the PATH environment variable is set to include ```go``` runtime.
 - ```jq```. You can install jq using ```sudo apt-get install -y jq```
 
-We will be creating the following resources as part of the deployment. 
+We will be creating the following resources as part of the deployment.
 
 - Azure Key Vault
 - Azure Storage account
@@ -246,7 +240,7 @@ cd $REPO_ROOT/scenarios/$SCENARIO/deployment/azure
 
 ### 3\. Contract Signing
 
-Navigate to the [contract-ledger](https://github.com/kapilvgit/contract-ledger/blob/main/README.md) repository and follow the instructions for contract signing.
+Navigate to the [contract-service](https://github.com/iSPIRT/contract-service/blob/main/README.md) repository and follow the instructions for contract signing.
 
 Once the contract is signed, export the contract sequence number as an environment variable in the same terminal where you set the environment variables for the deployment.
 
@@ -258,14 +252,14 @@ export CONTRACT_SEQ_NO=<contract-sequence-number>
 
 ### 4\. Data Encryption and Upload
 
-Using their respective keys, the TDPs and TDC encrypt their datasets and model (respectively) and upload them to the Storage containers created in the previous step.
+Using their respective keys, the TDPs and TDC encrypt their datasets and models (respectively) and upload them to the Storage containers created in the previous step.
 
 Navigate to the [Azure deployment](./deployment/azure/) directory and execute the scripts for key import, data encryption and upload to Azure Blob Storage, in preparation of the CCR deployment.
 
-The import-keys script generates and imports encryption keys into Azure Key Vault with a policy based on [policy-in-template.json](./policy/policy-in-template.json). The policy requires that the CCRs run specific containers with a specific configuration which includes the public identity of the contract service. Only CCRs that satisfy this policy will be granted access to the encryption keys. The generated keys are available as files with the extension `.bin`. 
+The import-keys script generates and imports encryption keys into Azure Key Vault with a policy based on [policy-in-template.json](./policy/policy-in-template.json). The policy requires that the CCRs run specific containers with a specific configuration which includes the public identity of the contract service. Only CCRs that satisfy this policy will be granted access to the encryption keys. The generated keys are available as files with the extension `.bin`.
 
 ```bash
-export CONTRACT_SERVICE_URL=https://depa-training-contract-service.centralindia.cloudapp.azure.com:8000
+export CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
 export TOOLS_HOME=$REPO_ROOT/external/confidential-sidecar-containers/tools
 
 ./3-import-keys.sh
@@ -300,9 +294,7 @@ Set the `$CONTRACT_SEQ_NO` variable to the exact value of the contract sequence
 export CONTRACT_SEQ_NO=15
 ```
 
-This script will deploy the container images from your container registry, including the encrypted filesystem sidecar. The sidecar will generate an SEV-SNP attestation report, generate an attestation token using the Microsoft Azure Attestation (MAA) service, retrieve dataset, model and output encryption keys from the TDP and TDC's Azure Key Vault, train the model, and save the resulting model into TDC's output filesystem image, which the TDC can later decrypt. 
-
-<!-- **Note:** if the contract-ledger repository is also located at the root of the same environment where this depa-training repo is, the `$CONTRACT_SEQ_NO` variable automatically picks up the sequence number of the latest contract that was signed between the TDPs and TDC. -->
+This script will deploy the container images from your container registry, including the encrypted filesystem sidecar. The sidecar will generate an SEV-SNP attestation report, generate an attestation token using the Microsoft Azure Attestation (MAA) service, retrieve dataset, model and output encryption keys from the TDP and TDC's Azure Key Vault, train the model, and save the resulting model into TDC's output filesystem image, which the TDC can later decrypt.
 
 **Note:** The completion of this script's execution simply creates a CCR instance, and doesn't indicate whether training has completed or not. The training process might still be ongoing. Poll the container logs (see below) to track progress until training is complete.
 
@@ -350,7 +342,7 @@ cd mnt/remote && ls
 
 ### 6\. Download and Decrypt Model
 
-Once training has completed succesfully (The training container logs will mention it explicitly), download and decrypt the trained model and other training outputs.
+Once training has completed successfully (The training container logs will mention it explicitly), download and decrypt the trained model and other training outputs.
 
 ```bash
 ./6-download-decrypt-model.sh
@@ -361,7 +353,7 @@ The outputs will be saved to the [output](./modeller/output/) directory.
 To check if the trained model is fresh, you can run the following command:
 
 ```bash
-stat $REPO_ROOT/scenarios/$SCENARIO/modeller/output/trained_model.onnx
+stat $REPO_ROOT/scenarios/$SCENARIO/modeller/output/trained_model.json
 ```
 
 ---
@@ -377,4 +369,4 @@ az group delete --yes --name $AZURE_RESOURCE_GROUP
 
 [1] [Anna Montoya, inversion, KirillOdintsov, and Martin Kotek. Home Credit Default Risk. https://kaggle.com/competitions/home-credit-default-risk, 2018. Kaggle.](https://www.kaggle.com/c/home-credit-default-risk)
 
-[2] [XGBoost](https://xgboost.readthedocs.io/en/stable/)
+[2] [XGBoost](https://xgboost.readthedocs.io/en/stable/)
\ No newline at end of file
diff --git a/scenarios/credit-risk/config/model_config.json b/scenarios/credit-risk/config/model_config.json
index 7a96174..2ed7194 100644
--- a/scenarios/credit-risk/config/model_config.json
+++ b/scenarios/credit-risk/config/model_config.json
@@ -1,9 +1,9 @@
 {
-    "num_boost_round": 250,
-    "booster_params": {
-        "max_depth": 6,
-        "learning_rate": 0.05,
-        "objective": "binary:logistic",
-        "eval_metric": "auc"
-    }
+    "n_estimators": 250,
+    "max_depth": 6,
+    "learning_rate": 0.05,
+    "l2_regularization": 1.0,
+    "min_child_weight": 1.0,
+    "objective": "binary:logistic",
+    "eval_metric": "auc"
 }
\ No newline at end of file
diff --git a/scenarios/credit-risk/config/pipeline_config.json b/scenarios/credit-risk/config/pipeline_config.json
index 49fff3a..af2c74c 100644
--- a/scenarios/credit-risk/config/pipeline_config.json
+++ b/scenarios/credit-risk/config/pipeline_config.json
@@ -118,18 +118,16 @@
         "is_private": true,
         "privacy_params": {
           "epsilon": 4.0,
-          "mechanism": "gaussian",
-          "delta": 0.00001,
-          "clip_value": 1.0
+          "delta": 0.00001
         },
         "model_config": {
-          "num_boost_round": 250,
-          "booster_params": {
-            "max_depth": 6,
-            "learning_rate": 0.05,
-            "objective": "binary:logistic",
-            "eval_metric": "auc"
-          }
+          "n_estimators": 250,
+          "max_depth": 6,
+          "learning_rate": 0.05,
+          "l2_regularization": 1.0,
+          "min_child_weight": 1.0,
+          "objective": "binary:logistic",
+          "eval_metric": "auc"
         },
         "dataset_config": {
           "type": "tabular",
diff --git a/scenarios/credit-risk/config/templates/train_config_template.json b/scenarios/credit-risk/config/templates/train_config_template.json
index 0f01ff1..1010ab9 100644
--- a/scenarios/credit-risk/config/templates/train_config_template.json
+++ b/scenarios/credit-risk/config/templates/train_config_template.json
@@ -8,9 +8,7 @@
         "is_private": true,
         "privacy_params": {
             "epsilon": 4.0,
-            "mechanism": "gaussian",
-            "delta": 1e-5,
-            "clip_value": 1.0
+            "delta": 0.00001
         }
     }
 }
\ No newline at end of file
diff --git a/scenarios/credit-risk/config/train_config.json b/scenarios/credit-risk/config/train_config.json
index b54c77c..d71d459 100644
--- a/scenarios/credit-risk/config/train_config.json
+++ b/scenarios/credit-risk/config/train_config.json
@@ -8,18 +8,16 @@
     "is_private": true,
     "privacy_params": {
       "epsilon": 4.0,
-      "mechanism": "gaussian",
-      "delta": 0.00001,
-      "clip_value": 1.0
+      "delta": 0.00001
     },
     "model_config": {
-      "num_boost_round": 250,
-      "booster_params": {
-        "max_depth": 6,
-        "learning_rate": 0.05,
-        "objective": "binary:logistic",
-        "eval_metric": "auc"
-      }
+      "n_estimators": 250,
+      "max_depth": 6,
+      "learning_rate": 0.05,
+      "l2_regularization": 1.0,
+      "min_child_weight": 1.0,
+      "objective": "binary:logistic",
+      "eval_metric": "auc"
     },
     "dataset_config": {
       "type": "tabular",
diff --git a/scenarios/credit-risk/contract/contract.json b/scenarios/credit-risk/contract/contract.json
index 2cbc573..44d4210 100644
--- a/scenarios/credit-risk/contract/contract.json
+++ b/scenarios/credit-risk/contract/contract.json
@@ -9,7 +9,8 @@
   "datasets": [
     {
       "id": "19517ba8-bab8-11ed-afa1-0242ac120002",
-      "name": "bank_a",
+      "name": "credit_applications",
+      "owner": "bank_a",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_BANK_A_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -25,7 +26,8 @@
     },
     {
       "id": "216d5cc6-bab8-11ed-afa1-0242ac120002",
-      "name": "bank_a",
+      "name": "previous_applications",
+      "owner": "bank_a",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_BANK_A_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -41,7 +43,8 @@
     },
     {
       "id": "2830a144-bab8-11ed-afa1-0242ac120002",
-      "name": "bank_a",
+      "name": "payment_installments",
+      "owner": "bank_a",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_BANK_A_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -57,7 +60,8 @@
     },
     {
       "id": "45647e76-bab8-11ed-afa1-0242ac120002",
-      "name": "bank_b",
+      "name": "credit_card_balance",
+      "owner": "bank_b",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_BANK_B_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -73,7 +77,8 @@
     },
     {
       "id": "3187712c-bab8-11ed-afa1-0242ac120002",
-      "name": "bureau",
+      "name": "bureau_records",
+      "owner": "bureau",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_BUREAU_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
@@ -89,7 +94,8 @@
     },
     {
       "id": "40e82c74-bab8-11ed-afa1-0242ac120002",
-      "name": "fintech",
+      "name": "pos_cash_balance",
+      "owner": "fintech",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_FINTECH_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
diff --git a/scenarios/credit-risk/deployment/azure/0-create-acr.sh b/scenarios/credit-risk/deployment/azure/0-create-acr.sh
index 4719bad..552e095 100755
--- a/scenarios/credit-risk/deployment/azure/0-create-acr.sh
+++ b/scenarios/credit-risk/deployment/azure/0-create-acr.sh
@@ -8,6 +8,15 @@ if [[ -z "$CONTAINER_REGISTRY" || -z "$AZURE_RESOURCE_GROUP" || -z "$AZURE_LOCAT
   exit 1
 fi
 
+# Remove .azurecr.io suffix if present (ACR names should not include the domain)
+CONTAINER_REGISTRY="${CONTAINER_REGISTRY%.azurecr.io}"
+
+# Validate ACR name: alphanumeric only, 5-50 characters
+if [[ ! "$CONTAINER_REGISTRY" =~ ^[a-zA-Z0-9]{5,50}$ ]]; then
+  echo "ERROR: Invalid ACR name '$CONTAINER_REGISTRY'. ACR names must be 5-50 alphanumeric characters only."
+  exit 1
+fi
+
 echo "Checking if ACR '$CONTAINER_REGISTRY' exists in resource group '$AZURE_RESOURCE_GROUP'..."
 
 # Check if ACR exists
@@ -32,11 +41,34 @@ else
 
   if [[ $? -eq 0 ]]; then
     echo "✅ ACR '$CONTAINER_REGISTRY' created successfully."
+    echo "⏳ Waiting for DNS propagation before login..."
+    sleep 10
   else
     echo "❌ Failed to create ACR."
     exit 1
   fi
 fi
 
-# Login to the ACR
-az acr login --name "$CONTAINER_REGISTRY"
\ No newline at end of file
+# Login to the ACR with retry mechanism (DNS propagation may take time)
+echo "Logging in to ACR '$CONTAINER_REGISTRY'..."
+MAX_RETRIES=15
+RETRY_DELAY=5
+RETRY_COUNT=0
+
+while [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; do
+  if az acr login --name "$CONTAINER_REGISTRY" 2>/dev/null; then
+    echo "✅ Successfully logged in to ACR '$CONTAINER_REGISTRY'."
+    exit 0
+  fi
+  
+  RETRY_COUNT=$((RETRY_COUNT + 1))
+  if [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; then
+    echo "⏳ Login attempt $RETRY_COUNT/$MAX_RETRIES failed. Retrying in ${RETRY_DELAY}s..."
+    sleep $RETRY_DELAY
+    RETRY_DELAY=$((RETRY_DELAY + 5))  # Exponential backoff
+  fi
+done
+
+echo "❌ Failed to login to ACR after $MAX_RETRIES attempts. DNS may still be propagating."
+echo "You can manually login later with: az acr login --name $CONTAINER_REGISTRY"
+exit 1
\ No newline at end of file
diff --git a/scenarios/credit-risk/deployment/azure/1-create-storage-containers.sh b/scenarios/credit-risk/deployment/azure/1-create-storage-containers.sh
index 6a103d2..f07bf7e 100755
--- a/scenarios/credit-risk/deployment/azure/1-create-storage-containers.sh
+++ b/scenarios/credit-risk/deployment/azure/1-create-storage-containers.sh
@@ -11,14 +11,20 @@ else
   echo "Resource group $AZURE_RESOURCE_GROUP already exists. Skipping creation."
 fi
 
-echo "Check if storage account $STORAGE_ACCOUNT_NAME exists..."
+echo "Check if storage account $AZURE_STORAGE_ACCOUNT_NAME exists..."
 STORAGE_ACCOUNT_EXISTS=$(az storage account check-name --name $AZURE_STORAGE_ACCOUNT_NAME --query "nameAvailable" --output tsv)
 
 if [ "$STORAGE_ACCOUNT_EXISTS" == "true" ]; then
   echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME does not exist. Creating it now..."
   az storage account create  --resource-group $AZURE_RESOURCE_GROUP  --name $AZURE_STORAGE_ACCOUNT_NAME
 else
-  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists. Skipping creation."
+  # Check if the storage account exists in the resource group
+  STORAGE_ACCOUNT_EXIST_IN_RG=$(az storage account show --name $AZURE_STORAGE_ACCOUNT_NAME --resource-group $AZURE_RESOURCE_GROUP --query "name" -o tsv 2>/dev/null)
+  if [ -z "$STORAGE_ACCOUNT_EXIST_IN_RG" ]; then
+    echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME is already reserved and does not exist in the $AZURE_RESOURCE_GROUP resource group. Please select a different name."
+    exit 1
+  fi
+  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists in the $AZURE_RESOURCE_GROUP resource group. Skipping creation."
 fi
 
 # Get the storage account key
diff --git a/scenarios/credit-risk/deployment/azure/2-create-akv.sh b/scenarios/credit-risk/deployment/azure/2-create-akv.sh
index c20a75e..3c4cfdc 100755
--- a/scenarios/credit-risk/deployment/azure/2-create-akv.sh
+++ b/scenarios/credit-risk/deployment/azure/2-create-akv.sh
@@ -12,7 +12,7 @@ if [[ "$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then
         --body "{\"name\": \"$AZURE_AKV_RESOURCE_NAME\", \"type\": \"Microsoft.KeyVault/vaults\"}" | jq -r '.nameAvailable')
     if [ "$NAME_AVAILABLE" == true ]; then
         echo "Key Vault $AZURE_AKV_RESOURCE_NAME does not exist. Creating it now..."
-        echo CREATING $AZURE_KEYVAULT_ENDPOINT in resouce group $AZURE_RESOURCE_GROUP
+        echo CREATING $AZURE_KEYVAULT_ENDPOINT in resource group $AZURE_RESOURCE_GROUP
         # Create Azure key vault with RBAC authorization
         az keyvault create --name $AZURE_AKV_RESOURCE_NAME --resource-group $AZURE_RESOURCE_GROUP --sku "Premium" --enable-rbac-authorization
         # Assign RBAC roles to the resource owner so they can import keys
@@ -20,7 +20,15 @@ if [[ "$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then
         az role assignment create --role "Key Vault Crypto Officer" --assignee `az account show --query user.name --output tsv` --scope $AKV_SCOPE
         az role assignment create --role "Key Vault Crypto User" --assignee `az account show --query user.name --output tsv` --scope $AKV_SCOPE
     else
-        echo "Key Vault $AZURE_AKV_RESOURCE_NAME already exists. Skipping creation."
+        # Name is not available — check if the vault exists in *this* subscription
+        if az keyvault show --name $AZURE_AKV_RESOURCE_NAME --resource-group $AZURE_RESOURCE_GROUP >/dev/null 2>&1; then
+            echo "Key Vault $AZURE_AKV_RESOURCE_NAME already exists in your subscription. Skipping creation."
+        else
+            echo "Key Vault name '$AZURE_AKV_RESOURCE_NAME' is already reserved."
+            echo "If you previously owned this Key Vault, it may be soft-deleted."
+            echo "Please purge the Key Vault before retrying."
+            exit 1
+        fi
     fi
 else
     echo "Automated creation of key vaults is supported only for vaults"
diff --git a/scenarios/credit-risk/deployment/azure/5-upload-encrypted-data.sh b/scenarios/credit-risk/deployment/azure/5-upload-encrypted-data.sh
index b12e1d2..00ded7c 100755
--- a/scenarios/credit-risk/deployment/azure/5-upload-encrypted-data.sh
+++ b/scenarios/credit-risk/deployment/azure/5-upload-encrypted-data.sh
@@ -1,14 +1,14 @@
 #!/bin/bash
 
-export DATA_DIR=$REPO_ROOT/scenarios/$SCENARIO/data
-export MODEL_DIR=$REPO_ROOT/scenarios/$SCENARIO/modeller
+DATADIR=$REPO_ROOT/scenarios/$SCENARIO/data
+MODELDIR=$REPO_ROOT/scenarios/$SCENARIO/modeller
 
 ACCOUNT_KEY=$(az storage account keys list --account-name $AZURE_STORAGE_ACCOUNT_NAME --only-show-errors | jq -r .[0].value)
 
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_BANK_A_CONTAINER_NAME \
-  --file $DATA_DIR/bank_a.img \
+  --file $DATADIR/bank_a.img \
   --name data.img \
   --type page \
   --overwrite \
@@ -17,7 +17,7 @@ az storage blob upload \
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_BANK_B_CONTAINER_NAME \
-  --file $DATA_DIR/bank_b.img \
+  --file $DATADIR/bank_b.img \
   --name data.img \
   --type page \
   --overwrite \
@@ -26,7 +26,7 @@ az storage blob upload \
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_BUREAU_CONTAINER_NAME \
-  --file $DATA_DIR/bureau.img \
+  --file $DATADIR/bureau.img \
   --name data.img \
   --type page \
   --overwrite \
@@ -35,7 +35,7 @@ az storage blob upload \
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_FINTECH_CONTAINER_NAME \
-  --file $DATA_DIR/fintech.img \
+  --file $DATADIR/fintech.img \
   --name data.img \
   --type page \
   --overwrite \
@@ -44,7 +44,7 @@ az storage blob upload \
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_OUTPUT_CONTAINER_NAME \
-  --file $MODEL_DIR/output.img \
+  --file $MODELDIR/output.img \
   --name data.img \
   --type page \
   --overwrite \
diff --git a/scenarios/credit-risk/deployment/azure/deploy.sh b/scenarios/credit-risk/deployment/azure/deploy.sh
index e69f399..6d60007 100755
--- a/scenarios/credit-risk/deployment/azure/deploy.sh
+++ b/scenarios/credit-risk/deployment/azure/deploy.sh
@@ -40,7 +40,7 @@ export PIPELINE_CONFIGURATION=`cat $pipelineConfiguration | base64 --wrap=0`
 function generate_encrypted_filesystem_information() {
   end=`date -u -d "60 minutes" '+%Y-%m-%dT%H:%MZ'`
   BANK_A_SAS_TOKEN=$(az storage blob generate-sas --account-name $AZURE_STORAGE_ACCOUNT_NAME --container-name $AZURE_BANK_A_CONTAINER_NAME --permissions r --name data.img --expiry $end --only-show-errors) 
-  export BANK_A_SAS_TOKEN="$(echo -n $BANK_A_SAS_TOKEN | tr -d \")"
+  export BANK_A_SAS_TOKEN=$(echo -n $BANK_A_SAS_TOKEN | tr -d \")
   export BANK_A_SAS_TOKEN="?$BANK_A_SAS_TOKEN"
 
   BANK_B_SAS_TOKEN=$(az storage blob generate-sas --account-name $AZURE_STORAGE_ACCOUNT_NAME --container-name $AZURE_BANK_B_CONTAINER_NAME --permissions r --name data.img --expiry $end --only-show-errors) 
diff --git a/scenarios/credit-risk/export-variables.sh b/scenarios/credit-risk/export-variables.sh
index d79c6a0..e33f123 100755
--- a/scenarios/credit-risk/export-variables.sh
+++ b/scenarios/credit-risk/export-variables.sh
@@ -30,7 +30,7 @@
 declare -x SCENARIO=credit-risk
 declare -x REPO_ROOT="$(git rev-parse --show-toplevel)"
 declare -x CONTAINER_REGISTRY=ispirt.azurecr.io
-declare -x AZURE_LOCATION=centralindia
+declare -x AZURE_LOCATION=<azure-location>
 declare -x AZURE_SUBSCRIPTION_ID=
 declare -x AZURE_RESOURCE_GROUP=
 declare -x AZURE_KEYVAULT_ENDPOINT=
@@ -43,7 +43,7 @@ declare -x AZURE_FINTECH_CONTAINER_NAME=fintechcontainer
 declare -x AZURE_OUTPUT_CONTAINER_NAME=outputcontainer
 
 # For key import:
-declare -x CONTRACT_SERVICE_URL=https://depa-training-contract-service.centralindia.cloudapp.azure.com:8000
+declare -x CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
 declare -x TOOLS_HOME=$REPO_ROOT/external/confidential-sidecar-containers/tools
 
 # Export all variables to make them available to other scripts
diff --git a/scenarios/mnist/.gitignore b/scenarios/mnist/.gitignore
index 0f7a6d2..98a3f1d 100644
--- a/scenarios/mnist/.gitignore
+++ b/scenarios/mnist/.gitignore
@@ -8,7 +8,7 @@
 *.gz
 
 # Ignore modeller output folder (relative to repo root)
-modeller/output/
+modeller/
 
 data/
 
diff --git a/scenarios/mnist/README.md b/scenarios/mnist/README.md
index b604360..2c51961 100644
--- a/scenarios/mnist/README.md
+++ b/scenarios/mnist/README.md
@@ -37,7 +37,7 @@ This script builds the following container images:
 - ```preprocess-mnist```: Container for pre-processing MNIST dataset. 
 - ```mnist-model-save```: Container that saves the model to be trained in ONNX format. 
 
-Alternatively, you can pull and use pre-built container images from the ispirt container registry by setting the following environment variable. Docker hub has started throttling which may effect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
+Alternatively, you can pull and use pre-built container images from the iSPIRT container registry by setting the following environment variable. Docker hub has started throttling which may affect the upload/download time, especially when images are bigger size. So, It is advisable to use other container registries. We are using Azure container registry (ACR) as shown below:
 
 ```bash
 export CONTAINER_REGISTRY=ispirt.azurecr.io
@@ -72,7 +72,7 @@ Assuming you have cleartext access to all the datasets, you can train the model
 ./train.sh
 ```
 
-The script joins the datasets and trains the model using a pipeline configuration. To modify the various components of the training pipeline, you can edit the training config files in the [config](./config/) directory. The training config files are used to create the pipeline configuration ([pipeline_config.json](./config/pipeline_config.json)) created by consolidating all the TDC's training config files, namely the [model config](./config/model_config.json), [dataset config](./config/dataset_config.json), [loss function config](./config/loss_config.json), [training config](./config/train_config_template.json), [evaluation config](./config/eval_config.json), and if multiple datasets are used, the [data join config](./config/join_config.json). These enable the TDC to design highly customized training pipelines without requiring review and approval of new custom code for each use case—reducing risks from potentially malicious or non-compliant code. The consolidated pipeline configuration is then attested against the signed contract using the TDP’s policy-as-code. If approved, it is executed in the CCR to train the model, which we will deploy in the next section.
+The script joins the datasets and trains the model using a pipeline configuration. To modify the various components of the training pipeline, you can edit the training config files in the [config](./config/) directory. The training config files are used to create the pipeline configuration ([pipeline_config.json](./config/pipeline_config.json)) created by consolidating all the TDC's training config files, namely the [model config](./config/model_config.json), [dataset config](./config/dataset_config.json), [loss function config](./config/loss_config.json), [training config](./config/train_config_template.json), [evaluation config](./config/eval_config.json), and if multiple datasets are used, the [data join config](./config/join_config.json). These enable the TDC to design highly customized training pipelines without requiring review and approval of new custom code for each use case — reducing risks from potentially malicious or non-compliant code. The consolidated pipeline configuration is then attested against the signed contract using the TDP's policy-as-code. If approved, it is executed in the CCR to train the model, which we will deploy in the next section.
 
 ```mermaid
 flowchart TD
@@ -123,15 +123,15 @@ train-1 exited with code 0
 
 ## Deploy on CCR
 
-In a more realistic scenario, this datasets will not be available in the clear to the TDC, and the TDC will be required to use a CCR for training. The following steps describe the process of sharing an encrypted dataset with TDCs and setting up a CCR in Azure for training. Please stay tuned for CCR on other cloud platforms. 
+In a more realistic scenario, these datasets will not be available in the clear to the TDC, and the TDC will be required to use a CCR for training. The following steps describe the process of sharing an encrypted dataset with TDCs and setting up a CCR in Azure for training. Please stay tuned for CCR on other cloud platforms.
 
 To deploy in Azure, you will need the following. 
 
-- Docker Hub account to store container images. Alternatively, you can use pre-built images from the ```ispirt``` container registry. 
-- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) to store encryption keys and implement secure key release to CCR. You can either you Azure Key Vault Premium (lower cost), or [Azure Key Vault managed HSM](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) for enhanced security. Please see instructions below on how to create and setup your AKV instance. 
-- Valid Azure subscription with sufficient access to create key vault, storage accounts, storage containers, and Azure Container Instances (ACI). 
+- Docker Hub account to store container images. Alternatively, you can use pre-built images from the ```iSPIRT``` container registry.
+- [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) to store encryption keys and implement secure key release to CCR. You can either use Azure Key Vault Premium (lower cost), or [Azure Key Vault managed HSM](https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) for enhanced security. Please see instructions below on how to create and set up your AKV instance.
+- Valid Azure subscription with sufficient access to create key vault, storage accounts, storage containers, and Azure Container Instances (ACI).
 
-If you are using your own development environment instead of a dev container or codespaces, you will to install the following dependencies. 
+If you are using your own development environment instead of a dev container or codespaces, you will need to install the following dependencies:
 
 - [Azure CLI](https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux).  
 - [Azure CLI Confidential containers extension](https://learn.microsoft.com/en-us/cli/azure/confcom?view=azure-cli-latest). After installing Azure CLI, you can install this extension using ```az extension add --name confcom -y```
@@ -239,7 +239,7 @@ cd $REPO_ROOT/scenarios/$SCENARIO/deployment/azure
 
 ### 3\. Contract Signing
 
-Navigate to the [contract-ledger](https://github.com/kapilvgit/contract-ledger/blob/main/README.md) repository and follow the instructions for contract signing.
+Navigate to the [contract-service](https://github.com/iSPIRT/contract-service/blob/main/README.md) repository and follow the instructions for contract signing.
 
 Once the contract is signed, export the contract sequence number as an environment variable in the same terminal where you set the environment variables for the deployment.
 
@@ -251,14 +251,14 @@ export CONTRACT_SEQ_NO=<contract-sequence-number>
 
 ### 4\. Data Encryption and Upload
 
-Using their respective keys, the TDPs and TDC encrypt their datasets and model (respectively) and upload them to the Storage containers created in the previous step.
+Using their respective keys, the TDPs and TDC encrypt their datasets and models (respectively) and upload them to the Storage containers created in the previous step.
 
 Navigate to the [Azure deployment](./deployment/azure/) directory and execute the scripts for key import, data encryption and upload to Azure Blob Storage, in preparation of the CCR deployment.
 
-The import-keys script generates and imports encryption keys into Azure Key Vault with a policy based on [policy-in-template.json](./policy/policy-in-template.json). The policy requires that the CCRs run specific containers with a specific configuration which includes the public identity of the contract service. Only CCRs that satisfy this policy will be granted access to the encryption keys. The generated keys are available as files with the extension `.bin`. 
+The import-keys script generates and imports encryption keys into Azure Key Vault with a policy based on [policy-in-template.json](./policy/policy-in-template.json). The policy requires that the CCRs run specific containers with a specific configuration which includes the public identity of the contract service. Only CCRs that satisfy this policy will be granted access to the encryption keys. The generated keys are available as files with the extension `.bin`.
 
 ```bash
-export CONTRACT_SERVICE_URL=https://depa-training-contract-service.centralindia.cloudapp.azure.com:8000
+export CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
 export TOOLS_HOME=$REPO_ROOT/external/confidential-sidecar-containers/tools
 
 ./3-import-keys.sh
@@ -293,9 +293,7 @@ Set the `$CONTRACT_SEQ_NO` variable to the exact value of the contract sequence
 export CONTRACT_SEQ_NO=15
 ```
 
-This script will deploy the container images from your container registry, including the encrypted filesystem sidecar. The sidecar will generate an SEV-SNP attestation report, generate an attestation token using the Microsoft Azure Attestation (MAA) service, retrieve dataset, model and output encryption keys from the TDP and TDC's Azure Key Vault, train the model, and save the resulting model into TDC's output filesystem image, which the TDC can later decrypt. 
-
-<!-- **Note:** if the contract-ledger repository is also located at the root of the same environment where this depa-training repo is, the `$CONTRACT_SEQ_NO` variable automatically picks up the sequence number of the latest contract that was signed between the TDPs and TDC. -->
+This script will deploy the container images from your container registry, including the encrypted filesystem sidecar. The sidecar will generate an SEV-SNP attestation report, generate an attestation token using the Microsoft Azure Attestation (MAA) service, retrieve dataset, model and output encryption keys from the TDP and TDC's Azure Key Vault, train the model, and save the resulting model into TDC's output filesystem image, which the TDC can later decrypt.
 
 **Note:** The completion of this script's execution simply creates a CCR instance, and doesn't indicate whether training has completed or not. The training process might still be ongoing. Poll the container logs (see below) to track progress until training is complete.
 
@@ -343,7 +341,7 @@ cd mnt/remote && ls
 
 ### 6\. Download and Decrypt Model
 
-Once training has completed succesfully (The training container logs will mention it explicitly), download and decrypt the trained model and other training outputs.
+Once training has completed successfully (The training container logs will mention it explicitly), download and decrypt the trained model and other training outputs.
 
 ```bash
 ./6-download-decrypt-model.sh
diff --git a/scenarios/mnist/ci/Dockerfile.modelsave b/scenarios/mnist/ci/Dockerfile.modelsave
index d58eb4a..ed6b1e9 100644
--- a/scenarios/mnist/ci/Dockerfile.modelsave
+++ b/scenarios/mnist/ci/Dockerfile.modelsave
@@ -12,6 +12,6 @@ RUN python3 get-pip.py
 
 ## Install dependencies
 RUN pip3 install torch --index-url https://download.pytorch.org/whl/cpu
-RUN pip3 --default-timeout=1000 install onnx 
+RUN pip3 --default-timeout=1000 install onnx onnxscript
 
 COPY save_base_model.py save_base_model.py
diff --git a/scenarios/mnist/contract/contract.json b/scenarios/mnist/contract/contract.json
index 91b3f32..b9d898a 100644
--- a/scenarios/mnist/contract/contract.json
+++ b/scenarios/mnist/contract/contract.json
@@ -9,7 +9,8 @@
   "datasets": [
     {
       "id": "19517ba8-bab8-11ed-afa1-0242ac120002",
-      "name": "mnist",
+      "owner": "mnist",
+      "name": "mnist-handwritten-digits",
       "url": "https://$AZURE_STORAGE_ACCOUNT_NAME.blob.core.windows.net/$AZURE_MNIST_CONTAINER_NAME/data.img",
       "provider": "",
       "key": {
diff --git a/scenarios/mnist/deployment/azure/0-create-acr.sh b/scenarios/mnist/deployment/azure/0-create-acr.sh
index 4719bad..552e095 100755
--- a/scenarios/mnist/deployment/azure/0-create-acr.sh
+++ b/scenarios/mnist/deployment/azure/0-create-acr.sh
@@ -8,6 +8,15 @@ if [[ -z "$CONTAINER_REGISTRY" || -z "$AZURE_RESOURCE_GROUP" || -z "$AZURE_LOCAT
   exit 1
 fi
 
+# Remove .azurecr.io suffix if present (ACR names should not include the domain)
+CONTAINER_REGISTRY="${CONTAINER_REGISTRY%.azurecr.io}"
+
+# Validate ACR name: alphanumeric only, 5-50 characters
+if [[ ! "$CONTAINER_REGISTRY" =~ ^[a-zA-Z0-9]{5,50}$ ]]; then
+  echo "ERROR: Invalid ACR name '$CONTAINER_REGISTRY'. ACR names must be 5-50 alphanumeric characters only."
+  exit 1
+fi
+
 echo "Checking if ACR '$CONTAINER_REGISTRY' exists in resource group '$AZURE_RESOURCE_GROUP'..."
 
 # Check if ACR exists
@@ -32,11 +41,34 @@ else
 
   if [[ $? -eq 0 ]]; then
     echo "✅ ACR '$CONTAINER_REGISTRY' created successfully."
+    echo "⏳ Waiting for DNS propagation before login..."
+    sleep 10
   else
     echo "❌ Failed to create ACR."
     exit 1
   fi
 fi
 
-# Login to the ACR
-az acr login --name "$CONTAINER_REGISTRY"
\ No newline at end of file
+# Login to the ACR with retry mechanism (DNS propagation may take time)
+echo "Logging in to ACR '$CONTAINER_REGISTRY'..."
+MAX_RETRIES=15
+RETRY_DELAY=5
+RETRY_COUNT=0
+
+while [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; do
+  if az acr login --name "$CONTAINER_REGISTRY" 2>/dev/null; then
+    echo "✅ Successfully logged in to ACR '$CONTAINER_REGISTRY'."
+    exit 0
+  fi
+  
+  RETRY_COUNT=$((RETRY_COUNT + 1))
+  if [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; then
+    echo "⏳ Login attempt $RETRY_COUNT/$MAX_RETRIES failed. Retrying in ${RETRY_DELAY}s..."
+    sleep $RETRY_DELAY
+    RETRY_DELAY=$((RETRY_DELAY + 5))  # Exponential backoff
+  fi
+done
+
+echo "❌ Failed to login to ACR after $MAX_RETRIES attempts. DNS may still be propagating."
+echo "You can manually login later with: az acr login --name $CONTAINER_REGISTRY"
+exit 1
\ No newline at end of file
diff --git a/scenarios/mnist/deployment/azure/1-create-storage-containers.sh b/scenarios/mnist/deployment/azure/1-create-storage-containers.sh
index 49c6ba6..8f1751d 100755
--- a/scenarios/mnist/deployment/azure/1-create-storage-containers.sh
+++ b/scenarios/mnist/deployment/azure/1-create-storage-containers.sh
@@ -11,14 +11,20 @@ else
   echo "Resource group $AZURE_RESOURCE_GROUP already exists. Skipping creation."
 fi
 
-echo "Check if storage account $STORAGE_ACCOUNT_NAME exists..."
+echo "Check if storage account $AZURE_STORAGE_ACCOUNT_NAME exists..."
 STORAGE_ACCOUNT_EXISTS=$(az storage account check-name --name $AZURE_STORAGE_ACCOUNT_NAME --query "nameAvailable" --output tsv)
 
 if [ "$STORAGE_ACCOUNT_EXISTS" == "true" ]; then
   echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME does not exist. Creating it now..."
   az storage account create  --resource-group $AZURE_RESOURCE_GROUP  --name $AZURE_STORAGE_ACCOUNT_NAME
 else
-  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists. Skipping creation."
+  # Check if the storage account exists in the resource group
+  STORAGE_ACCOUNT_EXIST_IN_RG=$(az storage account show --name $AZURE_STORAGE_ACCOUNT_NAME --resource-group $AZURE_RESOURCE_GROUP --query "name" -o tsv 2>/dev/null)
+  if [ -z "$STORAGE_ACCOUNT_EXIST_IN_RG" ]; then
+    echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME is already reserved and does not exist in the $AZURE_RESOURCE_GROUP resource group. Please select a different name."
+    exit 1
+  fi
+  echo "Storage account $AZURE_STORAGE_ACCOUNT_NAME already exists in the $AZURE_RESOURCE_GROUP resource group. Skipping creation."
 fi
 
 # Get the storage account key
diff --git a/scenarios/mnist/deployment/azure/2-create-akv.sh b/scenarios/mnist/deployment/azure/2-create-akv.sh
index c20a75e..3c4cfdc 100755
--- a/scenarios/mnist/deployment/azure/2-create-akv.sh
+++ b/scenarios/mnist/deployment/azure/2-create-akv.sh
@@ -12,7 +12,7 @@ if [[ "$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then
         --body "{\"name\": \"$AZURE_AKV_RESOURCE_NAME\", \"type\": \"Microsoft.KeyVault/vaults\"}" | jq -r '.nameAvailable')
     if [ "$NAME_AVAILABLE" == true ]; then
         echo "Key Vault $AZURE_AKV_RESOURCE_NAME does not exist. Creating it now..."
-        echo CREATING $AZURE_KEYVAULT_ENDPOINT in resouce group $AZURE_RESOURCE_GROUP
+        echo CREATING $AZURE_KEYVAULT_ENDPOINT in resource group $AZURE_RESOURCE_GROUP
         # Create Azure key vault with RBAC authorization
         az keyvault create --name $AZURE_AKV_RESOURCE_NAME --resource-group $AZURE_RESOURCE_GROUP --sku "Premium" --enable-rbac-authorization
         # Assign RBAC roles to the resource owner so they can import keys
@@ -20,7 +20,15 @@ if [[ "$AZURE_KEYVAULT_ENDPOINT" == *".vault.azure.net" ]]; then
         az role assignment create --role "Key Vault Crypto Officer" --assignee `az account show --query user.name --output tsv` --scope $AKV_SCOPE
         az role assignment create --role "Key Vault Crypto User" --assignee `az account show --query user.name --output tsv` --scope $AKV_SCOPE
     else
-        echo "Key Vault $AZURE_AKV_RESOURCE_NAME already exists. Skipping creation."
+        # Name is not available — check if the vault exists in *this* subscription
+        if az keyvault show --name $AZURE_AKV_RESOURCE_NAME --resource-group $AZURE_RESOURCE_GROUP >/dev/null 2>&1; then
+            echo "Key Vault $AZURE_AKV_RESOURCE_NAME already exists in your subscription. Skipping creation."
+        else
+            echo "Key Vault name '$AZURE_AKV_RESOURCE_NAME' is already reserved."
+            echo "If you previously owned this Key Vault, it may be soft-deleted."
+            echo "Please purge the Key Vault before retrying."
+            exit 1
+        fi
     fi
 else
     echo "Automated creation of key vaults is supported only for vaults"
diff --git a/scenarios/mnist/deployment/azure/5-upload-encrypted-data.sh b/scenarios/mnist/deployment/azure/5-upload-encrypted-data.sh
index b7f1ad0..473ab03 100755
--- a/scenarios/mnist/deployment/azure/5-upload-encrypted-data.sh
+++ b/scenarios/mnist/deployment/azure/5-upload-encrypted-data.sh
@@ -1,14 +1,14 @@
 #!/bin/bash
 
-export DATA_DIR=$REPO_ROOT/scenarios/$SCENARIO/data
-export MODEL_DIR=$REPO_ROOT/scenarios/$SCENARIO/modeller
+DATADIR=$REPO_ROOT/scenarios/$SCENARIO/data
+MODELDIR=$REPO_ROOT/scenarios/$SCENARIO/modeller
 
 ACCOUNT_KEY=$(az storage account keys list --account-name $AZURE_STORAGE_ACCOUNT_NAME --only-show-errors | jq -r .[0].value)
 
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_MNIST_CONTAINER_NAME \
-  --file $DATA_DIR/mnist.img \
+  --file $DATADIR/mnist.img \
   --name data.img \
   --type page \
   --overwrite \
@@ -17,7 +17,7 @@ az storage blob upload \
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_MODEL_CONTAINER_NAME \
-  --file $MODEL_DIR/model.img \
+  --file $MODELDIR/model.img \
   --name data.img \
   --type page \
   --overwrite \
@@ -26,7 +26,7 @@ az storage blob upload \
 az storage blob upload \
   --account-name $AZURE_STORAGE_ACCOUNT_NAME \
   --container $AZURE_OUTPUT_CONTAINER_NAME \
-  --file $MODEL_DIR/output.img \
+  --file $MODELDIR/output.img \
   --name data.img \
   --type page \
   --overwrite \
diff --git a/scenarios/mnist/export-variables.sh b/scenarios/mnist/export-variables.sh
index 6f9ae8c..4432632 100755
--- a/scenarios/mnist/export-variables.sh
+++ b/scenarios/mnist/export-variables.sh
@@ -30,7 +30,7 @@
 declare -x SCENARIO=mnist
 declare -x REPO_ROOT="$(git rev-parse --show-toplevel)"
 declare -x CONTAINER_REGISTRY=ispirt.azurecr.io
-declare -x AZURE_LOCATION=centralindia
+declare -x AZURE_LOCATION=<azure-location>
 declare -x AZURE_SUBSCRIPTION_ID=
 declare -x AZURE_RESOURCE_GROUP=
 declare -x AZURE_KEYVAULT_ENDPOINT=
@@ -41,7 +41,7 @@ declare -x AZURE_MODEL_CONTAINER_NAME=modelcontainer
 declare -x AZURE_OUTPUT_CONTAINER_NAME=outputcontainer
 
 # For key import:
-declare -x CONTRACT_SERVICE_URL=https://depa-training-contract-service.centralindia.cloudapp.azure.com:8000
+declare -x CONTRACT_SERVICE_URL=https://<contract-service-url>:8000
 declare -x TOOLS_HOME=$REPO_ROOT/external/confidential-sidecar-containers/tools
 
 # Export all variables to make them available to other scripts
diff --git a/scenarios/mnist/src/save_base_model.py b/scenarios/mnist/src/save_base_model.py
index ea0c725..de4aa33 100644
--- a/scenarios/mnist/src/save_base_model.py
+++ b/scenarios/mnist/src/save_base_model.py
@@ -18,6 +18,10 @@
 import torch 
 import torch.nn as nn
 import torch.nn.functional as F
+import os
+
+# Disable the new ONNX exporter and use the legacy one for compatibility
+os.environ["TORCH_ONNX_EXPERIMENTAL_RUNTIME_TYPE_CHECK"] = "ERRORS_ONLY"
 
 model_path="/mnt/model/"
 
@@ -44,5 +48,18 @@ def forward(self, x):
 # Define the input size for MNIST (batch_size, channels, height, width)
 dummy_input = torch.randn(1, 1, 28, 28)
 
-# Export the model
-torch.onnx.export(net, dummy_input, model_path + "model.onnx")
\ No newline at end of file
+# Export the model using legacy exporter
+# Use opset 11 for compatibility with onnx2pytorch
+with torch.no_grad():
+    torch.onnx.export(
+        net, 
+        dummy_input, 
+        model_path + "model.onnx",
+        export_params=True,
+        opset_version=11,
+        do_constant_folding=True,
+        input_names=['input'],
+        output_names=['output'],
+        verbose=False,
+        dynamo=False  # Use legacy exporter, not the new dynamo-based one
+    )
\ No newline at end of file
diff --git a/src/policy/policy.rego b/src/policy/policy.rego
index 64e8592..a513a00 100644
--- a/src/policy/policy.rego
+++ b/src/policy/policy.rego
@@ -20,7 +20,7 @@ all_datasets_in_contract_included if {
 		dataset.key.properties.kid == filesystem.key.kid
 
 		# file system mounted at a well-known point
-		filesystem.mount_point == concat("", ["/mnt/remote/", dataset.name])
+		filesystem.mount_point == concat("", ["/mnt/remote/", dataset.owner])
 
 		# file system must be mounted read only
 		filesystem.read_write == false
@@ -29,7 +29,7 @@ all_datasets_in_contract_included if {
 
 modeller_filesystem_mounted if {
 	# expect two additional filesystems (or one if model is instantiated from config in CCR)
-	providers = {p | p = data.datasets[_].name}
+	providers = {p | p = data.datasets[_].owner}
 	count(input.azure_filesystems) <= count(providers) + 2
 	count(input.azure_filesystems) > count(providers)
 }
diff --git a/src/train/.gitignore b/src/train/.gitignore
index fa702ce..1da5083 100644
--- a/src/train/.gitignore
+++ b/src/train/.gitignore
@@ -11,4 +11,6 @@ workspace/
 **/*.pid
 .mypy_cache/
 **/*.cose
-**/*.cbor
\ No newline at end of file
+**/*.cbor
+
+llm_finetune.py
\ No newline at end of file
diff --git a/src/train/pytrain/pipeline_executor.py b/src/train/pytrain/pipeline_executor.py
index 2cbf4a9..cc696d1 100644
--- a/src/train/pytrain/pipeline_executor.py
+++ b/src/train/pytrain/pipeline_executor.py
@@ -21,6 +21,7 @@
 from .join import *
 from .dl_train import Train_DL
 from .xgb_train import Train_XGB
+# from .llm_finetune import LLM_Finetune
 
 class PipelineExecutor:
     def __init__(self):
diff --git a/src/train/pytrain/utilities/dp_xgboost.py b/src/train/pytrain/utilities/dp_xgboost.py
deleted file mode 100644
index 23b7f13..0000000
--- a/src/train/pytrain/utilities/dp_xgboost.py
+++ /dev/null
@@ -1,281 +0,0 @@
-# 2025 DEPA Foundation
-#
-# This work is dedicated to the public domain under the CC0 1.0 Universal license.
-# To the extent possible under law, DEPA Foundation has waived all copyright and 
-# related or neighboring rights to this work. 
-# CC0 1.0 Universal (https://creativecommons.org/publicdomain/zero/1.0/)
-#
-# This software is provided "as is", without warranty of any kind, express or implied,
-# including but not limited to the warranties of merchantability, fitness for a 
-# particular purpose and noninfringement. In no event shall the authors or copyright
-# holders be liable for any claim, damages or other liability, whether in an action
-# of contract, tort or otherwise, arising from, out of or in connection with the
-# software or the use or other dealings in the software.
-#
-# For more information about this framework, please visit:
-# https://depa.world/training/depa_training_framework/
-
-from typing import Any, Dict, Optional, Sequence, Tuple
-import json
-import math
-import logging
-
-import numpy as np
-import xgboost as xgb
-
-logger = logging.getLogger(__name__)
-logging.basicConfig(level=logging.INFO)
-
-
-class DPXGBoost:
-    def __init__(self, xgb_params, privacy_params = None):
-        """
-        xgb_params: config passed to xgb.train
-        privacy_params: optional config.
-            mechanism: 'laplace' or 'gaussian'
-            epsilon: float (required)
-            delta: float (required when gaussian)
-            clip_value: float (required)
-        """
-        self.xgb_params = xgb_params
-        self.privacy_params = privacy_params
-        self.privacy_enabled = True if privacy_params is not None else False
-
-        # Validate privacy params only if enabled
-        if self.privacy_enabled:
-            mech = self.privacy_params.get('mechanism', 'gaussian')
-            if mech not in ('laplace', 'gaussian'):
-                raise ValueError("mechanism must be 'laplace' or 'gaussian'")
-            if 'epsilon' not in self.privacy_params:
-                raise ValueError('epsilon is required in privacy_params when privacy enabled')
-            if mech == 'gaussian' and 'delta' not in self.privacy_params:
-                raise ValueError('delta is required for gaussian mechanism')
-            if 'clip_value' not in self.privacy_params:
-                raise ValueError('clip_value is required in privacy_params')
-
-        # bookkeeping
-        self.bst: Optional[xgb.Booster] = None
-        self._noisy_leaf_values: Optional[Dict[Tuple[int, int], float]] = None
-        self._orig_leaf_values: Optional[Dict[Tuple[int, int], float]] = None
-        self._trained_num_trees: Optional[int] = None
-
-    # Delegation: let wrapper expose Booster attributes once a booster exists
-    def __getattr__(self, name: str):
-        if name.startswith("_"):
-            raise AttributeError(name)
-        if self.bst is not None and hasattr(self.bst, name):
-            return getattr(self.bst, name)
-        raise AttributeError(f"{self.__class__.__name__} has no attribute {name}")
-
-
-    def fit(self,
-            X: Any = None,
-            y: Any = None,
-            num_boost_round: int = 100,
-            dtrain: Optional[xgb.DMatrix] = None,
-            evals: Optional[Sequence[Tuple[xgb.DMatrix, str]]] = None,
-            **train_kwargs) -> xgb.Booster:
-        """
-        Train via xgb.train. If privacy enabled, compute noisy leaf mapping.
-        """
-        if dtrain is None:
-            if X is None or y is None:
-                raise ValueError("Provide either dtrain or X and y")
-            dtrain = xgb.DMatrix(X, label=y)
-
-        if self.privacy_enabled:
-            logger.info("Privacy enabled: DP noise will be computed after training.")
-        else:
-            logger.info("Privacy disabled: running standard non-DP training.")
-
-        # Train using xgboost's train (delegates heavy training to xgboost)
-        self.bst = xgb.train(self.xgb_params, dtrain, num_boost_round=num_boost_round, evals=evals, **train_kwargs)
-
-        # cache number of trees (dump length)
-        dump = self.bst.get_dump(dump_format='json')
-        self._trained_num_trees = len(dump)
-        logger.info("Trained %d trees", self._trained_num_trees)
-
-        # original leaf values
-        self._orig_leaf_values = self._extract_leaf_values(self.bst)
-
-        # compute noisy mapping only if enabled, otherwise copy original map
-        if self.privacy_enabled:
-            self._noisy_leaf_values = self._compute_dp_leaf_noise(self.bst, dtrain)
-        else:
-            self._noisy_leaf_values = dict(self._orig_leaf_values)
-
-        return self.bst
-
-    def predict(self, X: Any, dp: bool = False, **predict_kwargs) -> np.ndarray:
-        """
-        If dp=False: delegate to underlying Booster.predict.
-        If dp=True:
-          - If privacy disabled -> returns same as non-DP predictions (we use noisy_map==orig_map).
-          - If privacy enabled -> compute predictions by summing noisy leaf values.
-        NOTE: For binary classification with objective 'binary:logistic', booster.predict(dp=False)
-        returns probabilities, whereas predict(dp=True) returns the raw margin from base_score +
-        sum(eta * noisy_leaf). Convert with sigmoid if you need probability-like output.
-        """
-        if self.bst is None:
-            raise ValueError("Model not trained yet. Call fit(...) first.")
-
-        dmat = xgb.DMatrix(X)
-        if not dp:
-            return self.bst.predict(dmat, **predict_kwargs)
-
-        # dp prediction (noisy leaf aggregation)
-        if self._noisy_leaf_values is None or self._orig_leaf_values is None:
-            raise ValueError("No leaf mappings available. Call fit(...) first.")
-
-        leaves = self.bst.predict(dmat, pred_leaf=True)
-        n_samples, n_trees = leaves.shape
-        if self._trained_num_trees is not None and n_trees != self._trained_num_trees:
-            logger.warning("pred_leaf reported %d trees but trained had %d", n_trees, self._trained_num_trees)
-
-        lr = float(self.xgb_params.get("eta", self.xgb_params.get("learning_rate", 0.3)))
-        base = float(self.xgb_params.get("base_score", 0.5))
-
-        preds = np.full(n_samples, base, dtype=float)
-
-        for t in range(n_trees):
-            # build vector of leaf values for tree t
-            tree_vals = np.zeros(n_samples, dtype=float)
-            for i in range(n_samples):
-                leaf_id = int(leaves[i, t])
-                key = (t, leaf_id)
-                val = self._noisy_leaf_values.get(key)
-                if val is None:
-                    val = self._orig_leaf_values.get(key, 0.0)
-                tree_vals[i] = val
-            preds += lr * tree_vals
-
-        return preds
-
-    def save_model(self, path: str) -> None:
-        if self.bst is None:
-            raise ValueError("No trained model to save")
-        return self.bst.save_model(path)
-
-    def load_model(self, path: str) -> xgb.Booster:
-        self.bst = xgb.Booster()
-        self.bst.load_model(path)
-        dump = self.bst.get_dump(dump_format='json')
-        self._trained_num_trees = len(dump)
-        self._orig_leaf_values = self._extract_leaf_values(self.bst)
-        self._noisy_leaf_values = None
-        return self.bst
-
-    def get_booster(self) -> Optional[xgb.Booster]:
-        return self.bst
-
-    # ----------------
-    # Internal helpers
-    # ----------------
-    def _extract_leaf_values(self, booster: xgb.Booster) -> Dict[Tuple[int, int], float]:
-        """
-        Return mapping (tree_idx, nodeid) -> leaf_value.
-        Prefer trees_to_dataframe, fallback to JSON dump parsing.
-        """
-        mapping: Dict[Tuple[int, int], float] = {}
-        try:
-            df = booster.trees_to_dataframe()
-            if "Leaf" in df.columns:
-                leaf_rows = df.loc[df["Leaf"].notnull(), ["Tree", "Node", "Leaf"]]
-                for _, row in leaf_rows.iterrows():
-                    t = int(row["Tree"])
-                    nodeid = int(row["Node"])
-                    val = float(row["Leaf"])
-                    mapping[(t, nodeid)] = val
-                if mapping:
-                    return mapping
-        except Exception:
-            logger.debug("trees_to_dataframe failed; falling back to JSON parse", exc_info=True)
-
-        dump = booster.get_dump(dump_format="json")
-        for t, tree_json in enumerate(dump):
-            try:
-                tree = json.loads(tree_json)
-            except Exception:
-                continue
-
-            def _walk(node):
-                if "leaf" in node:
-                    nodeid = int(node.get("nodeid", -1))
-                    mapping[(t, nodeid)] = float(node["leaf"])
-                else:
-                    if "children" in node and isinstance(node["children"], list):
-                        for c in node["children"]:
-                            _walk(c)
-                    else:
-                        for k in ("yes", "no", "missing"):
-                            child = node.get(k)
-                            if isinstance(child, dict):
-                                _walk(child)
-
-            if isinstance(tree, dict):
-                _walk(tree)
-            elif isinstance(tree, list):
-                for node in tree:
-                    _walk(node)
-
-        return mapping
-
-    def _compute_dp_leaf_noise(self, booster: xgb.Booster, dtrain: xgb.DMatrix) -> Dict[Tuple[int, int], float]:
-        """
-        Compute noisy leaf mapping using a simple per-tree uniform budget split.
-        Sensitivity approximated as: clip_value / (leaf_count * min_hessian + l2_reg)
-        """
-        if self._orig_leaf_values is None:
-            self._orig_leaf_values = self._extract_leaf_values(booster)
-
-        leaves = booster.predict(dtrain, pred_leaf=True)
-        n_samples, n_trees = leaves.shape
-        num_trees = n_trees
-
-        # counts per (tree, leaf)
-        leaf_counts: Dict[Tuple[int, int], int] = {}
-        for i in range(n_samples):
-            for t in range(num_trees):
-                leafid = int(leaves[i, t])
-                key = (t, leafid)
-                leaf_counts[key] = leaf_counts.get(key, 0) + 1
-
-        mech = self.privacy_params.get("mechanism", "gaussian")
-        epsilon = float(self.privacy_params["epsilon"])
-        delta = float(self.privacy_params.get("delta", 0.0))
-        clip = float(self.privacy_params["clip_value"])
-        min_hessian = float(self.privacy_params.get("min_hessian", 1.0))
-        budget_alloc = self.privacy_params.get("budget_allocation", "uniform")
-        privacy_seed = self.privacy_params.get("privacy_seed", None)
-
-        l2_reg = float(self.xgb_params.get("lambda", self.xgb_params.get("reg_lambda", 1.0)))
-
-        if budget_alloc != "uniform":
-            logger.warning("Only uniform budget_allocation supported; falling back to uniform")
-        eps_per_tree = epsilon / max(1, num_trees)
-        delta_per_tree = (delta / max(1, num_trees)) if mech == "gaussian" and delta > 0 else None
-
-        rng = np.random.default_rng(privacy_seed)
-
-        noisy_map: Dict[Tuple[int, int], float] = {}
-        for (t, leafid), orig_val in self._orig_leaf_values.items():
-            count = leaf_counts.get((t, leafid), 0)
-            denom = count * min_hessian + l2_reg
-            if denom <= 0:
-                denom = 1e-6
-            sensitivity = clip / denom
-
-            if mech == "laplace":
-                scale = sensitivity / max(1e-12, eps_per_tree)
-                noise = rng.laplace(0.0, scale)
-            else:
-                if delta_per_tree is None or delta_per_tree <= 0:
-                    raise ValueError("delta must be positive for gaussian mechanism")
-                sigma = math.sqrt(2.0 * math.log(1.25 / delta_per_tree)) * sensitivity / max(1e-12, eps_per_tree)
-                noise = rng.normal(0.0, sigma)
-
-            noisy_map[(t, leafid)] = float(orig_val + noise)
-
-        logger.info("Computed noisy leaf mapping for %d trees", num_trees)
-        return noisy_map
\ No newline at end of file
diff --git a/src/train/pytrain/xgb_train.py b/src/train/pytrain/xgb_train.py
index c3ab57d..356e1e3 100644
--- a/src/train/pytrain/xgb_train.py
+++ b/src/train/pytrain/xgb_train.py
@@ -20,6 +20,7 @@
 from typing import Any, Dict, Optional, Tuple
 
 import numpy as np
+from sklearn.metrics import mean_squared_error
 import torch
 
 from .task_base import TaskBase
@@ -27,8 +28,8 @@
 from .utilities.eval_tools import compute_metrics
 
 import xgboost as xgb
-from .utilities.dp_xgboost import DPXGBoost
-from sklearn.metrics import mean_squared_error
+# Sarus Tech dp-xgboost library (use their xgb namespace)
+import dp_xgboost as dp_xgb
 
 def _to_numpy(array_like: Any) -> np.ndarray:
     try:
@@ -76,24 +77,44 @@ def _extract_xy_from_split(split_ds: Any) -> Tuple[np.ndarray, Optional[np.ndarr
 
 
 class Train_XGB(TaskBase):
-    """Train (DP-)XGBoost models.
+    """Train (DP-)XGBoost models using Sarus Tech's dp-xgboost library.
+    - Uses xgb.train() API (not sklearn XGBClassifier/XGBRegressor)
+    - Enables DP via tree_method='approxDP' parameter
+    - Requires DMatrix with feature_min/feature_max bounds
+    - Uses dp_epsilon_per_tree = total_epsilon / n_estimators
+    - Automatically handles class imbalance with scale_pos_weight
 
     Expected config snippet:
     {
         "task_type": "classification" | "regression",
         "dataset_config": {...},
-        "paths": {"input_dataset_path": "/path", "trained_model_output_path": "/out"},
-        "model_config": {
-            "n_estimators": 300, 
-            "max_depth": 6,
-            "learning_rate": 0.1,
-            "objective": "binary:logistic",
-            "num_class": 2,
-            "booster_params": {"tree_method": "hist", ...}  # optional, passed to underlying booster
-        },
+        "paths": {"input_dataset_path": "...", "trained_model_output_path": "..."},
         "is_private": true,
-        "privacy_params": {"mechanism": "gaussian", "epsilon": 2.0, "delta": 1e-5, "clip_value": 1.0}  # used by some dp-xgboost forks
+        "privacy_params": {
+            "epsilon": 4.0,  # Total privacy budget (split across trees)
+            "delta": 1e-5    # Privacy parameter (typically 1/n^2)
+        },
+        "model_config": {
+            "n_estimators": 250,            # Number of boosting rounds
+            "max_depth": 6,                 # Maximum tree depth
+            "learning_rate": 0.05,          # Learning rate (eta)
+            "l2_regularization": 1.0,       # L2 regularization (lambda)
+            "min_child_weight": 1.0,        # Minimum sum of instance weight
+            "subsample": 1.0,               # Subsample ratio (affects privacy)
+            "objective": "binary:logistic", # Loss function
+            "seed": 42,                     # Random seed for reproducibility
+            "scale_pos_weight": None        # Optional: override auto-calculated value
+        }
     }
+    
+    Implementation Details:
+    - Total epsilon is divided: dp_epsilon_per_tree = epsilon / n_estimators
+    - Actual epsilon spent: n_trees * log(1 + subsample*(e^eps_per_tree - 1))
+    - When is_private=True, both DP and non-DP models are trained for comparison
+    - Feature bounds are automatically computed from training data
+    - scale_pos_weight is automatically calculated for imbalanced classes
+    
+    Reference: https://github.com/Sarus-Tech/dp-xgboost
     """
 
     def init(self, config: Dict[str, Any]):
@@ -110,8 +131,13 @@ def init(self, config: Dict[str, Any]):
         self.y_val = None
         self.X_test = None
         self.y_test = None
-
-        self.model = None
+        
+        self.bst = None  # DP booster
+        self.non_dp_bst = None  # Non-DP baseline booster
+        
+        # Feature bounds required for DP
+        self.feature_min = None
+        self.feature_max = None
 
     def load_data(self):
         dataset_cfg = self.config.get("dataset_config", {})
@@ -128,56 +154,231 @@ def load_data(self):
             self.X_test, self.y_test = _extract_xy_from_split(all_splits["test"])
 
         print(f"Loaded dataset splits | train: {self.X_train.shape} | val: {None if self.X_val is None else self.X_val.shape} | test: {None if self.X_test is None else self.X_test.shape}")
-
-    def load_model(self):
-        xgb_params = self.config["model_config"]["booster_params"]
-        self.model = DPXGBoost(xgb_params, privacy_params=self.privacy_config)
+        
+        # Calculate scale_pos_weight for class imbalance (classification only)
+        self.scale_pos_weight = None
+        if self.task_type == "classification" and self.y_train is not None:
+            unique, counts = np.unique(self.y_train, return_counts=True)
+            class_counts = dict(zip(unique, counts))
+            
+            # For binary classification, calculate scale_pos_weight
+            if len(unique) == 2 and 0 in class_counts and 1 in class_counts:
+                # scale_pos_weight = count(negative) / count(positive)
+                self.scale_pos_weight = class_counts[0] / class_counts[1]
+                print(f"Class imbalance detected: {class_counts}")
+                print(f"Calculated scale_pos_weight: {self.scale_pos_weight:.4f}")
+        
+        # Compute feature bounds (required for DP)
+        if self.is_private:
+            n_features = self.X_train.shape[1]
+            self.feature_min = [float(np.min(self.X_train[:, i])) for i in range(n_features)]
+            self.feature_max = [float(np.max(self.X_train[:, i])) for i in range(n_features)]
+            print(f"Feature bounds for DP: min: {np.mean(self.feature_min):.4f}, max: {np.mean(self.feature_max):.4f}")
 
     def train(self):
-        num_boost_round = self.config["model_config"]["num_boost_round"]
-        self.model.fit(X=self.X_train, y=self.y_train, num_boost_round=num_boost_round)
+        """Train the model using Sarus Tech's DP-XGBoost with xgb.train() API."""
+        model_config = self.config["model_config"]
+        
+        # model parameters
+        n_estimators = model_config.get("n_estimators", 100)
+        max_depth = model_config.get("max_depth", 6)
+        learning_rate = model_config.get("learning_rate", 0.1)
+        l2_reg = model_config.get("l2_regularization", 1.0)
+        min_child_weight = model_config.get("min_child_weight", 1.0)
+        objective = model_config.get("objective", "binary:logistic" if self.task_type == "classification" else "reg:squarederror")
+        default_base_score = 0.5 if self.task_type == "classification" else 0.0
+        base_score = model_config.get("base_score", default_base_score)
+        subsample = model_config.get("subsample", 1.0)
+        seed = model_config.get("seed", 42)  # Random seed for reproducibility
+        
+        # Handle class imbalance with scale_pos_weight (can be overridden in config)
+        scale_pos_weight = model_config.get("scale_pos_weight", self.scale_pos_weight)
+        
         if self.is_private:
-            eps_string = f"Epsilon: {self.privacy_config['epsilon']}"
+            epsilon = self.privacy_config.get("epsilon", 1.0)
+            delta = self.privacy_config.get("delta", 1e-5)
+            
+            # Calculate per-tree epsilon budget (important for composition)
+            dp_epsilon_per_tree = epsilon / n_estimators
+            # Calculate total budget spent using advanced composition
+            total_budget_spent = n_estimators * np.log(1 + subsample * (np.exp(dp_epsilon_per_tree) - 1))
+            
+            print(f"\n[DEBUG] DP Model Configuration:")
+            print(f"  - n_estimators: {n_estimators}")
+            print(f"  - max_depth: {max_depth}")
+            print(f"  - learning_rate: {learning_rate}")
+            print(f"  - lambda (l2_reg): {l2_reg}")
+            print(f"  - min_child_weight: {min_child_weight}")
+            print(f"  - subsample: {subsample}")
+            print(f"  - objective: {objective}")
+            print(f"  - epsilon (total): {epsilon}, delta: {delta}")
+            print(f"  - dp_epsilon_per_tree: {dp_epsilon_per_tree:.6f}")
+            print(f"  - Total epsilon spent (with composition): {total_budget_spent:.4f}")
+            print(f"  - tree_method: approxDP (REQUIRED for DP)")
+            print(f"  - dp_xgboost version: {getattr(dp_xgb, '__version__', 'unknown')}")
+            
+            # Create DMatrix with feature bounds (REQUIRED for DP)
+            dtrain = dp_xgb.DMatrix(
+                self.X_train, 
+                label=self.y_train,
+                feature_min=self.feature_min,
+                feature_max=self.feature_max
+            )
+            
+            # DP parameters for xgb.train()
+            params_dp = {
+                'objective': objective,
+                'tree_method': 'approxDP',  # CRITICAL: This enables DP
+                'dp_epsilon_per_tree': dp_epsilon_per_tree,
+                'max_depth': max_depth,
+                'learning_rate': learning_rate,
+                'lambda': l2_reg,
+                'base_score': base_score,
+                'subsample': subsample,
+                'min_child_weight': min_child_weight,
+                'seed': seed,  # Set seed for reproducible DP noise
+            }
+            
+            # Add scale_pos_weight if available (for class imbalance)
+            if scale_pos_weight is not None:
+                params_dp['scale_pos_weight'] = scale_pos_weight
+                print(f"  - scale_pos_weight: {scale_pos_weight:.4f} (handling class imbalance)")
+            
+            # Train DP model
+            print(f"\nTraining DP model with ε={epsilon:.2f}")
+            self.bst = dp_xgb.train(params_dp, dtrain, num_boost_round=n_estimators)
+            print("DP model trained")
+            
+            # Train non-DP baseline for comparison
+            print("\nTraining non-DP baseline model for comparison...")
+            
+            # non-DP parameters (use 'approx' tree_method, not 'approxDP')
+            params_non_dp = {
+                'objective': objective,
+                'tree_method': 'approx',  # Standard (non-DP) method
+                'max_depth': max_depth,
+                'learning_rate': learning_rate,
+                'lambda': l2_reg,
+                'base_score': base_score,
+                'subsample': subsample,
+                'min_child_weight': min_child_weight,
+                'seed': seed,  # Same seed for fair comparison
+            }
+            
+            # Add scale_pos_weight if available (for class imbalance)
+            if scale_pos_weight is not None:
+                params_non_dp['scale_pos_weight'] = scale_pos_weight
+            
+            # Create regular DMatrix (no feature bounds needed)
+            dtrain_non_dp = xgb.DMatrix(self.X_train, label=self.y_train)
+            # Train non-DP model
+            self.non_dp_bst = xgb.train(params_non_dp, dtrain_non_dp, num_boost_round=n_estimators)
+            print("Non-DP baseline model trained")
+            
         else:
-            eps_string = "Non DP"
-        print(f"Trained Gradient Boosting model with {num_boost_round} boosting rounds | {eps_string}")
+            # Standard non-DP training
+            params_non_dp = {
+                'objective': objective,
+                'tree_method': 'approx',
+                'max_depth': max_depth,
+                'learning_rate': learning_rate,
+                'lambda': l2_reg,
+                'base_score': base_score,
+                'subsample': subsample,
+                'min_child_weight': min_child_weight,
+                'seed': seed,  # Set seed for reproducibility
+            }
+            
+            # Add scale_pos_weight if available (for class imbalance)
+            if scale_pos_weight is not None:
+                params_non_dp['scale_pos_weight'] = scale_pos_weight
+                print(f"Using scale_pos_weight: {scale_pos_weight:.4f} (handling class imbalance)")
+            
+            dtrain = xgb.DMatrix(self.X_train, label=self.y_train)
+            self.bst = xgb.train(params_non_dp, dtrain, num_boost_round=n_estimators)
+            print(f"Trained standard XGBoost model with {n_estimators} boosting rounds")
 
     def save_model(self):
         save_path = os.path.join(self.paths["trained_model_output_path"], "trained_model.json")
-        self.model.save_model(save_path)
-        print(f"Saved model to {self.paths['trained_model_output_path']}")
+        # Save the booster directly
+        if self.bst is not None:
+            self.bst.save_model(save_path)
+            print(f"Saved model to {self.paths['trained_model_output_path']}")
+
 
     def inference_and_eval(self):
+        """Run inference and evaluation on test set."""
         if self.X_test is None:
             print("No test split provided; skipping evaluation.")
             return
 
-        preds_list = []
-        targets_list = []
-        non_dp_preds_list = []
-
+        # Create DMatrix for test set
         if self.is_private:
-            preds_list = self.model.predict(X=self.X_test, dp=True)
-            non_dp_preds_list = self.model.predict(X=self.X_test, dp=False)
+            dtest = dp_xgb.DMatrix(
+                self.X_test,
+                feature_min=self.feature_min,
+                feature_max=self.feature_max
+            )
         else:
-            preds_list = self.model.predict(X=self.X_test, dp=False)
-
+            dtest = xgb.DMatrix(self.X_test)
+        
+        # Get predictions from DP model
+        preds_raw = self.bst.predict(dtest)
+        
+        # For classification, convert to binary predictions
+        if self.task_type == "classification":
+            preds_list = (preds_raw > 0.5).astype(int)
+        else:
+            preds_list = preds_raw
+        
         targets_list = self.y_test
 
+        print(f"\n{'='*60}")
+        print(f"DP Model Evaluation (ε={self.privacy_config['epsilon']})" if self.is_private else "Model Evaluation")
+        print(f"{'='*60}")
         numeric_metrics = compute_metrics(preds_list, targets_list, None, self.config)
         print(f"Evaluation Metrics: {numeric_metrics}")
 
-        if self.is_private:
-            os.makedirs(os.path.join(self.paths["trained_model_output_path"], "non_dp"), exist_ok=True)
-            self.config["paths"]["trained_model_output_path"] = os.path.join(self.paths["trained_model_output_path"], "non_dp")
+        # Evaluate non-DP baseline model if available
+        if self.is_private and self.non_dp_bst is not None:
+            dtest_non_dp = xgb.DMatrix(self.X_test)
+            non_dp_preds_raw = self.non_dp_bst.predict(dtest_non_dp)
+            
+            # For classification, convert to binary predictions
+            if self.task_type == "classification":
+                non_dp_preds_list = (non_dp_preds_raw > 0.5).astype(int)
+            else:
+                non_dp_preds_list = non_dp_preds_raw
+            
+            original_output_path = self.paths["trained_model_output_path"]
+            non_dp_output_path = os.path.join(original_output_path, "non_dp")
+            os.makedirs(non_dp_output_path, exist_ok=True)
+            self.config["paths"]["trained_model_output_path"] = non_dp_output_path
+            
+            print(f"\n{'='*60}")
+            print(f"Non-DP Baseline Model Evaluation")
+            print(f"{'='*60}")
             non_dp_numeric_metrics = compute_metrics(non_dp_preds_list, targets_list, None, self.config)
             print(f"Non-DP Evaluation Metrics: {non_dp_numeric_metrics}")
+            self.config["paths"]["trained_model_output_path"] = original_output_path
+            
+            # Print comparison
+            print(f"\n{'='*60}")
+            print(f"Privacy-Utility Trade-off Summary")
+            print(f"{'='*60}")
+            if 'accuracy' in numeric_metrics and 'accuracy' in non_dp_numeric_metrics:
+                utility_loss = non_dp_numeric_metrics['accuracy'] - numeric_metrics['accuracy']
+                print(f"Accuracy Loss due to DP: {utility_loss:.4f} ({utility_loss*100:.2f}%)")
+            if 'roc_auc' in numeric_metrics and 'roc_auc' in non_dp_numeric_metrics:
+                auc_loss = non_dp_numeric_metrics['roc_auc'] - numeric_metrics['roc_auc']
+                print(f"ROC-AUC Loss due to DP: {auc_loss:.4f} ({auc_loss*100:.2f}%)")
+            print(f"Privacy Budget: ε={self.privacy_config['epsilon']}, δ={self.privacy_config['delta']}")
+            print(f"{'='*60}\n")
 
     def execute(self, config: Dict[str, Any]):
         try:
             self.init(config)
             self.load_data()
-            self.load_model()
             self.train()
             self.save_model()
             self.inference_and_eval()
@@ -188,3 +389,4 @@ def execute(self, config: Dict[str, Any]):
             raise e
 
 
+