model-registry-governance

Name: model-registry-governance
Author: BagelHole

42stars4forks

How to install model-registry-governance?

bagelhole/devops-security-agent-skills/model-registry-governance

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill model-registry-governance

Installs into the current project.

Summary

Establish model registry standards, governance controls, metadata schemas, approvals, and lifecycle policies for enterprise AI deployments.

Files · 1

View on GitHub

SKILL.md

1	# Model Registry Governance
2
3	Create a trustworthy system of record for model artifacts, prompts, adapters, and evaluation evidence.
4
5	## When to Use This Skill
6
7	- Setting up a centralized model registry for your organization
8	- Defining metadata standards for model artifacts
9	- Building approval workflows for model promotion to production
10	- Implementing lifecycle policies for model retirement
11	- Preparing for compliance audits of AI systems
12
13	## Prerequisites
14
15	- MLflow Tracking Server or Weights & Biases instance deployed
16	- Object storage for model artifacts (S3, GCS, or MinIO)
17	- CI/CD pipeline with access to the registry API
18	- OPA or similar policy engine for governance checks
19	- Git repository for policy definitions and promotion scripts
20
21	## Core Principles
22
23	- Traceability: every production model maps to source code, data snapshot, and evaluation results.
24	- Reproducibility: builds are deterministic with pinned dependencies.
25	- Policy-driven promotion: no manual bypass for critical safety checks.
26	- Lifecycle hygiene: stale, vulnerable, or unowned models are retired automatically.
27
28	## MLflow Registry Setup
29
30	```bash
31	# Install MLflow with required backends
32	pip install mlflow[extras] psycopg2-binary boto3
33
34	# Start MLflow tracking server with PostgreSQL backend and S3 artifact store
35	mlflow server \
36	--backend-store-uri postgresql://mlflow:password@db:5432/mlflow \
37	--default-artifact-root s3://mlflow-artifacts/models \
38	--host 0.0.0.0 \
39	--port 5000 \
40	--serve-artifacts
41	```
42
43	```yaml
44	# docker-compose.yaml for MLflow
45	services:
46	mlflow:
47	image: ghcr.io/mlflow/mlflow:2.12.0
48	command: >
49	mlflow server
50	--backend-store-uri postgresql://mlflow:${DB_PASSWORD}@db:5432/mlflow
51	--default-artifact-root s3://mlflow-artifacts/models
52	--host 0.0.0.0
53	--port 5000
54	--serve-artifacts
55	ports:
56	- "5000:5000"
57	environment:
58	AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
59	AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
60	depends_on:
61	- db
62
63	db:
64	image: postgres:16-alpine
65	environment:
66	POSTGRES_DB: mlflow
67	POSTGRES_USER: mlflow
68	POSTGRES_PASSWORD: ${DB_PASSWORD}
69	volumes:
70	- pgdata:/var/lib/postgresql/data
71
72	volumes:
73	pgdata:
74	```
75
76	## Required Metadata Schema
77
78	```python
79	# model_metadata_schema.py
80	from pydantic import BaseModel, Field
81	from typing import List, Optional
82	from datetime import datetime
83	from enum import Enum
84
85	class LifecycleState(str, Enum):
86	DRAFT = "draft"
87	CANDIDATE = "candidate"
88	APPROVED = "approved"
89	DEPRECATED = "deprecated"
90	RETIRED = "retired"
91
92	class RiskRating(str, Enum):
93	LOW = "low"
94	MEDIUM = "medium"
95	HIGH = "high"
96	CRITICAL = "critical"
97
98	class ModelMetadata(BaseModel):
99	"""Required metadata for every registered model."""
100	# Identity
101	name: str = Field(description="Model name matching registry key")
102	version: str = Field(description="Semantic version")
103	checksum: str = Field(description="SHA-256 of model artifact")
104	storage_uri: str = Field(description="Artifact store path")
105
106	# Lineage
107	base_model: str = Field(description="Parent model identifier")
108	fine_tune_method: Optional[str] = Field(default=None)
109	training_dataset: Optional[str] = Field(default=None)
110	training_date: Optional[datetime] = Field(default=None)
111	source_commit: str = Field(description="Git SHA of training code")
112
113	# Evaluation
114	eval_datasets: List[str] = Field(description="Evaluation dataset IDs")
115	eval_report_uri: str = Field(description="Path to evaluation results")
116	quality_score: float = Field(ge=0, le=1)
117	safety_score: float = Field(ge=0, le=1)
118
119	# Governance
120	license: str = Field(description="SPDX license identifier")
121	allowed_use_cases: List[str]
122	prohibited_use_cases: List[str]
123	risk_rating: RiskRating
124	security_controls: List[str]
125
126	# Ownership
127	owner: str = Field(description="Primary owner email")
128	backup_owner: str = Field(description="Backup owner email")
129	escalation_contact: str
130	team: str
131
132	# Lifecycle
133	state: LifecycleState = LifecycleState.DRAFT
134	created_at: datetime = Field(default_factory=datetime.utcnow)
135	approved_at: Optional[datetime] = None
136	approved_by: Optional[str] = None
137	expires_at: Optional[datetime] = None
138	```
139
140	## Model Registration Script
141
142	```python
143	# register_model.py
144	import mlflow
145	from mlflow.tracking import MlflowClient
146	import json
147	import hashlib
148
149	def register_model(
150	model_path: str,
151	model_name: str,
152	metadata: dict,
153	mlflow_uri: str = "http://mlflow:5000"
154	):
155	"""Register a model with full metadata and governance tags."""
156	mlflow.set_tracking_uri(mlflow_uri)
157	client = MlflowClient()
158
159	# Compute artifact ch

People who liked this also viewed

6 picks

Type

model-registry-governance

42stars4forks

View on GitHub

How to install model-registry-governance?

bagelhole/devops-security-agent-skills/model-registry-governance

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill model-registry-governance

Installs into the current project.

Summary

Establish model registry standards, governance controls, metadata schemas, approvals, and lifecycle policies for enterprise AI deployments.

Files · 1

View on GitHub

SKILL.md

1	# Model Registry Governance
2
3	Create a trustworthy system of record for model artifacts, prompts, adapters, and evaluation evidence.
4
5	## When to Use This Skill
6
7	- Setting up a centralized model registry for your organization
8	- Defining metadata standards for model artifacts
9	- Building approval workflows for model promotion to production
10	- Implementing lifecycle policies for model retirement
11	- Preparing for compliance audits of AI systems
12
13	## Prerequisites
14
15	- MLflow Tracking Server or Weights & Biases instance deployed
16	- Object storage for model artifacts (S3, GCS, or MinIO)
17	- CI/CD pipeline with access to the registry API
18	- OPA or similar policy engine for governance checks
19	- Git repository for policy definitions and promotion scripts
20
21	## Core Principles
22
23	- Traceability: every production model maps to source code, data snapshot, and evaluation results.
24	- Reproducibility: builds are deterministic with pinned dependencies.
25	- Policy-driven promotion: no manual bypass for critical safety checks.
26	- Lifecycle hygiene: stale, vulnerable, or unowned models are retired automatically.
27
28	## MLflow Registry Setup
29
30	```bash
31	# Install MLflow with required backends
32	pip install mlflow[extras] psycopg2-binary boto3
33
34	# Start MLflow tracking server with PostgreSQL backend and S3 artifact store
35	mlflow server \
36	--backend-store-uri postgresql://mlflow:password@db:5432/mlflow \
37	--default-artifact-root s3://mlflow-artifacts/models \
38	--host 0.0.0.0 \
39	--port 5000 \
40	--serve-artifacts
41	```
42
43	```yaml
44	# docker-compose.yaml for MLflow
45	services:
46	mlflow:
47	image: ghcr.io/mlflow/mlflow:2.12.0
48	command: >
49	mlflow server
50	--backend-store-uri postgresql://mlflow:${DB_PASSWORD}@db:5432/mlflow
51	--default-artifact-root s3://mlflow-artifacts/models
52	--host 0.0.0.0
53	--port 5000
54	--serve-artifacts
55	ports:
56	- "5000:5000"
57	environment:
58	AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
59	AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
60	depends_on:
61	- db
62
63	db:
64	image: postgres:16-alpine
65	environment:
66	POSTGRES_DB: mlflow
67	POSTGRES_USER: mlflow
68	POSTGRES_PASSWORD: ${DB_PASSWORD}
69	volumes:
70	- pgdata:/var/lib/postgresql/data
71
72	volumes:
73	pgdata:
74	```
75
76	## Required Metadata Schema
77
78	```python
79	# model_metadata_schema.py
80	from pydantic import BaseModel, Field
81	from typing import List, Optional
82	from datetime import datetime
83	from enum import Enum
84
85	class LifecycleState(str, Enum):
86	DRAFT = "draft"
87	CANDIDATE = "candidate"
88	APPROVED = "approved"
89	DEPRECATED = "deprecated"
90	RETIRED = "retired"
91
92	class RiskRating(str, Enum):
93	LOW = "low"
94	MEDIUM = "medium"
95	HIGH = "high"
96	CRITICAL = "critical"
97
98	class ModelMetadata(BaseModel):
99	"""Required metadata for every registered model."""
100	# Identity
101	name: str = Field(description="Model name matching registry key")
102	version: str = Field(description="Semantic version")
103	checksum: str = Field(description="SHA-256 of model artifact")
104	storage_uri: str = Field(description="Artifact store path")
105
106	# Lineage
107	base_model: str = Field(description="Parent model identifier")
108	fine_tune_method: Optional[str] = Field(default=None)
109	training_dataset: Optional[str] = Field(default=None)
110	training_date: Optional[datetime] = Field(default=None)
111	source_commit: str = Field(description="Git SHA of training code")
112
113	# Evaluation
114	eval_datasets: List[str] = Field(description="Evaluation dataset IDs")
115	eval_report_uri: str = Field(description="Path to evaluation results")
116	quality_score: float = Field(ge=0, le=1)
117	safety_score: float = Field(ge=0, le=1)
118
119	# Governance
120	license: str = Field(description="SPDX license identifier")
121	allowed_use_cases: List[str]
122	prohibited_use_cases: List[str]
123	risk_rating: RiskRating
124	security_controls: List[str]
125
126	# Ownership
127	owner: str = Field(description="Primary owner email")
128	backup_owner: str = Field(description="Backup owner email")
129	escalation_contact: str
130	team: str
131
132	# Lifecycle
133	state: LifecycleState = LifecycleState.DRAFT
134	created_at: datetime = Field(default_factory=datetime.utcnow)
135	approved_at: Optional[datetime] = None
136	approved_by: Optional[str] = None
137	expires_at: Optional[datetime] = None
138	```
139
140	## Model Registration Script
141
142	```python
143	# register_model.py
144	import mlflow
145	from mlflow.tracking import MlflowClient
146	import json
147	import hashlib
148
149	def register_model(
150	model_path: str,
151	model_name: str,
152	metadata: dict,
153	mlflow_uri: str = "http://mlflow:5000"
154	):
155	"""Register a model with full metadata and governance tags."""
156	mlflow.set_tracking_uri(mlflow_uri)
157	client = MlflowClient()
158
159	# Compute artifact ch

People who liked this also viewed

6 picks

Type