Model registry is an authoritative catalog of versioned model artifacts, metadata, lineage, approvals and deployment status. It turns an opaque checkpoint file into a governed release object that can be reproduced, promoted, deployed, monitored, revoked and rolled back. A registry may store artifacts directly or reference immutable object storage; it links model to code, data, tokenizer, environment, metrics, signatures, licenses, security scans and deployment history. A production definition states the service or pipeline boundary, tenants, workload and data classes, dependency graph, consistency and durability expectations, capacity envelope, latency and availability objectives, failure model, trust zones, deployment units, ownership, and evidence required for release. Architecture diagrams and service-level indicators must refer to the same boundary. Define identity/version semantics, artifact formats, lineage, stage or alias workflow, approval authority, access, retention, immutability, signatures, replication, API and integration with serving.

Architecture, control plane, and operating behavior. Training logs artifacts and metadata, validation attaches reports, registry creates a version, gates promote aliases such as candidate or production, deployment controllers resolve immutable digests, monitoring links outcomes, and retraining creates a new version rather than mutating history. Package and checksum, upload, register lineage, scan, compare against gates, approve, assign stage/alias, deploy by digest, observe, roll back by previous digest, deprecate and retain or delete under policy. MLflow, Weights & Biases, SageMaker and Vertex AI registries differ in open/self-hosted versus managed integration, artifact handling, governance, lineage and cloud coupling. OCI registries can store model packages with custom metadata. The operational stack spans clients and producers, APIs or ingestion, queues and schedulers, stateless and stateful compute, accelerators, memory and storage, network fabrics, identity and policy, artifact registries, observability, automation, and human operations. Control-plane decisions and data-plane work are separated so overload or compromise in one does not silently corrupt the other. Evaluation combines correctness and model quality with throughput, p50/p95/p99 latency, queue depth, saturation, availability, error and retry rates, freshness, data loss, recovery time, recovery point, capacity, utilization, memory, network, energy, cost, and operator toil. Service-level objectives use user-visible good events, explicit windows, and error budgets rather than infrastructure uptime alone.

Implementation, infrastructure, and failure modes. Use content hashes and immutable versions, signed manifests, typed model signatures, environment locks, stage transitions as audited events, policy-as-code gates, least privilege, cross-region backups and deployment by exact digest. Large model uploads and multi-region replication consume storage and bandwidth; serving needs staged distribution to GPU nodes, local caches and capacity-aware rollout. Registry control plane should not sit on the hot inference path. Mutable tags point to new content, metadata and bytes diverge, tokenizer is missing, corrupt multipart upload is accepted, approval is bypassed, production depends on unavailable registry, or deletion breaks rollback. Implementation favors immutable artifacts, declarative configuration, typed schemas, idempotent operations, bounded retries with jitter, deadlines, backpressure, health and readiness probes, least privilege, encrypted transport and storage, progressive rollout, reproducible environments, and complete telemetry. Automation has dry-run, approval, audit, and rollback paths. AI infrastructure joins CPUs, GPUs or NPUs, HBM, host memory, NICs and DPUs, PCIe and scale-up links, leaf-spine networks, local and shared storage, power delivery, and cooling. Topology, NUMA locality, bandwidth, failure domains, thermal headroom, and accelerator memory determine delivered behavior and must be visible to schedulers. Common failures include retry storms, queue collapse, stale health signals, split brain, partial writes, incompatible schemas, silent data corruption, time skew, dependency amplification, capacity fragmentation, noisy neighbors, credential leakage, unbounded state, monitoring blind spots, and recovery procedures that exist only on paper. A healthy component does not prove a healthy user journey.

Verification, security, and lifecycle controls. Verify checksum/signature, load in clean environment, schema and runtime compatibility, artifact round trips, authorization, promotion and rollback, registry outage, replication, audit completeness and disaster restore. Artifact integrity, lineage completeness, registration-to-deploy time, approval duration, rollback success, cache hit, replication lag, unauthorized attempts, storage, stale versions and incident rate matter. Ownership, license, data provenance, privacy, model cards, safety/security evaluation, separation of duties, retention, legal hold, revocation and deployment authorization are core registry functions. Verification combines unit, contract and property tests, schema compatibility, load and soak tests, chaos and fault injection, security review, backup restoration, failover and rollback drills, dependency degradation, regional evacuation where applicable, data reconciliation, shadow traffic, canaries, and end-to-end synthetic checks. Tests run against production-like scale and permissions. Source, data, configuration, environment, model, registry metadata, infrastructure definition, dependency, image, driver, firmware, deployment, experiment, approval, incident, and rollback artifacts remain linked. Continuous controls detect drift, expired credentials, unowned resources, stale backups, regressions, policy exceptions, and unsupported versions. Owners define access, segregation of duties, data classification, residency, retention and deletion, vendor and supply-chain review, incident severity, communications, audit evidence, RTO/RPO or SLO exceptions, cost attribution, and change authority. Sensitive model and experiment artifacts receive the same integrity and confidentiality controls as source and production data.

<svg viewBox="0 0 760 470" xmlns="http://www.w3.org/2000/svg" font-family="-apple-system,Segoe UI,Roboto,sans-serif"><rect width="760" height="470" fill="#0d1117"/><defs><marker id="arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="6" markerHeight="6" orient="auto-start-reverse"><path d="M0 0L10 5L0 10Z" fill="#60a5fa"/></marker><filter id="glow"><feGaussianBlur stdDeviation="6"/></filter></defs><text x="380" y="34" fill="#e6edf3" font-size="21" font-weight="700" text-anchor="middle">Model Registry — Lineage from Run to Production</text><text x="380" y="56" fill="#8b98a5" font-size="13" text-anchor="middle">immutable versions carry evidence, approvals, and deployment stage</text><path d="M84 235H676" stroke="#3a4453" stroke-width="5"/><g transform="translate(72 115)"><path d="M0 20q0-20 62-20t62 20v132q0 20-62 20T0 152Z" fill="#141b28" stroke="#60a5fa"/><ellipse cx="62" cy="20" rx="62" ry="20" fill="#10233b" stroke="#60a5fa"/><text x="62" y="24" fill="#93c5fd" font-size="11" text-anchor="middle">training run</text><text x="62" y="72" fill="#cbd5e1" font-size="10" text-anchor="middle">git a81f</text><text x="62" y="94" fill="#cbd5e1" font-size="10" text-anchor="middle">data v17</text><text x="62" y="116" fill="#6ee7b7" font-size="10" text-anchor="middle">F1 .927</text></g><path d="M199 235H244" stroke="#60a5fa" stroke-width="2" marker-end="url(#arrow)"/><g transform="translate(250 128)"><rect width="106" height="214" rx="9" fill="#171421" stroke="#a78bfa"/><text x="53" y="28" fill="#c4b5fd" font-size="12" font-weight="700" text-anchor="middle">model v12</text><path d="M15 48h76M15 87h76M15 126h76" stroke="#3a4453"/><text x="53" y="71" fill="#8b98a5" font-size="10" text-anchor="middle">artifact hash</text><text x="53" y="110" fill="#8b98a5" font-size="10" text-anchor="middle">evaluation</text><text x="53" y="149" fill="#8b98a5" font-size="10" text-anchor="middle">owner + notes</text><circle cx="53" cy="181" r="15" fill="#392d12" stroke="#f59e0b"/><path d="M45 181l6 7 11-14" fill="none" stroke="#fbbf24" stroke-width="2"/></g><path d="M357 235H411" stroke="#a78bfa" stroke-width="2" marker-end="url(#arrow)"/><g transform="translate(418 157)"><rect width="92" height="70" rx="8" fill="#2a2112" stroke="#f59e0b"/><text x="46" y="30" fill="#fbbf24" font-size="11" font-weight="700" text-anchor="middle">STAGING</text><text x="46" y="50" fill="#8b98a5" font-size="10" text-anchor="middle">shadow test</text></g><path d="M511 192H565" stroke="#f59e0b" stroke-width="2" marker-end="url(#arrow)"/><g transform="translate(572 133)"><path d="M0 18h112v176H0Z" fill="#123c35" stroke="#34d399" stroke-width="2"/><path d="M0 18L56 0l56 18" fill="#164e3d" stroke="#34d399"/><text x="56" y="53" fill="#6ee7b7" font-size="12" font-weight="700" text-anchor="middle">PRODUCTION</text><circle cx="56" cy="92" r="27" fill="#0d1117" stroke="#34d399"/><path d="M42 92l10 11 19-25" fill="none" stroke="#6ee7b7" stroke-width="4"/><text x="56" y="139" fill="#8b98a5" font-size="10" text-anchor="middle">deployed v12</text><text x="56" y="159" fill="#8b98a5" font-size="10" text-anchor="middle">traffic 100%</text></g><path d="M628 331C530 418 329 404 303 344" fill="none" stroke="#f87171" stroke-width="2" stroke-dasharray="7 5" marker-end="url(#arrow)"/><text x="473" y="407" fill="#fca5a5" font-size="10.5" text-anchor="middle">rollback selects a previous immutable version</text><text x="380" y="452" fill="#6b7684" font-size="11.5" text-anchor="middle">A registry is a governance system: lineage, evidence, ownership, approval, deployment, and rollback.</text></svg>

Selection and production application. Use MLflow for open interoperable workflows, W&B for integrated experiment/artifact collaboration, managed cloud registries for native deployment governance and OCI-style packaging when existing supply-chain controls are strong. Training, CI/CD, batch scoring, online inference, edge release, regulated validation, A/B tests and rollback use model registries. The registry links experiment tracking, data lineage, CI, policy, artifact storage, deployment, monitoring and incident recovery. The useful optimization and reliability boundary is the complete user-facing system. Improving a model server, network, registry, deployment controller, or pipeline stage can move the bottleneck or weaken consistency, safety, recoverability, and cost elsewhere, so decisions are validated end to end. A production definition states the service or pipeline boundary, tenants, workload and data classes, dependency graph, consistency and durability expectations, capacity envelope, latency and availability objectives, failure model, trust zones, deployment units, ownership, and evidence required for release. Architecture diagrams and service-level indicators must refer to the same boundary. Evaluation combines correctness and model quality with throughput, p50/p95/p99 latency, queue depth, saturation, availability, error and retry rates, freshness, data loss, recovery time, recovery point, capacity, utilization, memory, network, energy, cost, and operator toil. Service-level objectives use user-visible good events, explicit windows, and error budgets rather than infrastructure uptime alone. CFS connects this topic to semiconductor architecture, implementation, verification, manufacturing, packaging, test, and deployed AI-system tradeoffs across the platform.