ODH-ADR-ML-0001: Consolidate AI asset registries on MLflow

[etirelli]

Summary

• Adds ODH-ADR-0008 documenting the decision to adopt MLflow as the unified registry backend for all AI asset types in OpenShift AI.
• Establishes architectural principles: registry–catalog separation (AI Hub as catalog; users import curated artifacts into the workspace registry), metadata-first design, federated plugin model per asset type, and upstream-first development.
• Rejects alternatives of separate per-asset registries and a meta-registry abstraction above MLflow.

Test plan

• Architecture stakeholders review ADR content and stakeholder table
• Confirm ADR number 0008 does not conflict with in-flight ADRs
• Verify links to MLflow RFCs (Skills Registry, MCP Registry) resolve correctly

Made with Cursor

Summary by CodeRabbit

• Documentation
  • Added an architecture decision record to document consolidating governed AI asset registries on MLflow, while keeping AI Hub as the catalog/discovery layer.
  • Defined guiding principles (registry–catalog separation, metadata-first, federated per-asset plugins, upstream-first) plus included scope, constraints, security considerations, and acknowledged migration risks.

[coderabbitai]

Warning

Review limit reached

@etirelli, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 37 minutes and 48 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 734380dd-0a6b-4841-9200-a953e44a3e3f

📥 Commits

Reviewing files that changed from the base of the PR and between d9b339d and 42ce220.

📒 Files selected for processing (1)

• architecture-decision-records/mlflow/ODH-ADR-ML-0001-consolidate-ai-asset-registries-on-mlflow.md

📝 Walkthrough

Walkthrough

This PR adds an architecture decision record establishing MLflow as the unified governance backend for OpenShift AI asset types (models, prompts, skills, MCP servers, agents) while AI Hub remains the catalog and discovery layer. The ADR specifies architectural principles (registry–catalog separation, metadata-first design, federated plugins per asset type, upstream-first development), documents in-scope asset consolidation paths, explicitly rejects fragmented multi-registry and abstraction-layer alternatives, and enumerates resulting constraints (mandatory MLflow use for new governed assets, plugin conformity to MLflow patterns, upstream-first default). Security and privacy considerations address executable content lifecycle gating and RBAC alignment with OpenShift. Documented risks include upstream dependency and migration complexity. Stakeholder impacts are enumerated by team with identified contacts.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 10

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and clearly reflects the primary change: introduction of an ADR documenting the decision to consolidate AI asset registries on MLflow.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Contribution Quality And Spam Detection	✅ Passed	Established contributor (21 prior commits) adding legitimate ADR documentation. No spam signals: substantive domain-specific content from Red Hat AI Architect, not a security fix, no false vulnerab...
No Hardcoded Secrets	✅ Passed	The PR adds a markdown ADR documentation file with no hardcoded API keys, tokens, passwords, private keys, base64 secrets, or credential-bearing URLs. All external links reference public GitHub rep...
No Weak Cryptography	✅ Passed	PR adds documentation and configuration files only; no cryptographic implementations, banned primitives, or insecure comparisons present in any added files.
No Injection Vectors	✅ Passed	PR adds only a Markdown documentation file (ADR). No executable code, SQL queries, shell commands, eval/exec patterns, unsafe deserialization, or XSS-vulnerable code detected. Injection checks (CWE...
No Privileged Containers	✅ Passed	PR adds only a Markdown ADR document with no Kubernetes manifests, Helm templates, Dockerfiles, or container configurations. No privileged container settings to flag.
No Sensitive Data In Logs	✅ Passed	PR adds a markdown ADR document with no code or logging statements. Comprehensive regex search for passwords, tokens, API keys, PII, session IDs, and logging functions found zero matches. Check not...

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@architecture-decision-records/ODH-ADR-0008-consolidate-ai-asset-registries-on-mlflow.md`:
- Around line 149-152: Update the ADR by adding a concrete "Fallback and
Rollback Criteria" (or "Resilience Addendum") section referenced from the
"Upstream dependency" and "Migration complexity" paragraphs: define explicit
trigger conditions (e.g., X% error rate, API semantic drift detected, failed
dual-write verification), acceptance gates for each migration phase (deprecation
→ dual-stack → removal), required verification checks (read-after-write checks,
data consistency sampling), automated rollback actions (disable MLflow writes,
switch to Kubeflow reads/writes or a read-only mode), responsible roles/contacts
for decision and timeframe for rollback, and telemetry/alerting metrics and
runbook links to enable a safe rollback path.
- Around line 143-146: The ADR currently lists risks under "Executable content"
and "Access control" but lacks enforceable promotion controls; update the ADR to
require mandatory promotion gates for executable assets (MCP servers, skills) by
specifying: (1) mandatory artifact provenance metadata and cryptographic
signature verification before any promotion, (2) an admission/policy check
(e.g., cluster admission controller or MLflow hook) that rejects promotions
lacking valid signatures or provenance, (3) integration of registry RBAC with
OpenShift RBAC so promotion APIs honor namespace-level permissions, (4)
deny-by-default promotion workflows in MLflow that only allow promote actions
via a vetted service account or CI pipeline, and (5) audit logging and alerting
on failed or bypassed promotion attempts; reference the "Executable content" and
"Access control" sections, MLflow promotion APIs, registry RBAC, OpenShift RBAC,
and MCP/skill artifacts when adding these mandatory controls.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 58ae9e62-5f2a-49b5-91bc-9e160d025e51

📥 Commits

Reviewing files that changed from the base of the PR and between 423c1f6 and 34f8ecf.

📒 Files selected for processing (1)

• architecture-decision-records/ODH-ADR-0008-consolidate-ai-asset-registries-on-mlflow.md

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

architecture-decision-records/mlflow/ODH-ADR-ML-0001-consolidate-ai-asset-registries-on-mlflow.md (1)

12-12: ⚠️ Potential issue | 🟡 Minor

Update stale RFC links: both referenced RFCs do not resolve to active documents.

Line 12 references two MLflow RFC links that do not point to current, active RFC content. The Skills Registry RFC link (mlflow/rfcs#10) refers to a closed or non-existent pull request; the associated work is at https://github.com/mlflow/skills instead. The MCP Registry RFC link (https://github.com/mlflow/rfcs/tree/main/rfcs/0004-mcp-registry) is not an active document in the rfcs repository—MCP registry implementation has proceeded via standard issues and PRs in the main MLflow repository. Remove these broken links or replace with the correct GitHub references.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@architecture-decision-records/mlflow/ODH-ADR-ML-0001-consolidate-ai-asset-registries-on-mlflow.md`
at line 12, In the "Other docs" section of line 12, update the two stale RFC
links in the "Other docs" field. Replace the Skills Registry RFC link (the
closed pull request reference) with the correct reference to the MLflow skills
repository work. Replace the MCP Registry RFC link (the inactive
rfcs/0004-mcp-registry reference) with appropriate links to the standard issues
and PRs in the main MLflow repository where the actual MCP registry
implementation has proceeded. Ensure both links now point to current, active
documentation or project locations.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In
`@architecture-decision-records/mlflow/ODH-ADR-ML-0001-consolidate-ai-asset-registries-on-mlflow.md`:
- Line 12: In the "Other docs" section of line 12, update the two stale RFC
links in the "Other docs" field. Replace the Skills Registry RFC link (the
closed pull request reference) with the correct reference to the MLflow skills
repository work. Replace the MCP Registry RFC link (the inactive
rfcs/0004-mcp-registry reference) with appropriate links to the standard issues
and PRs in the main MLflow repository where the actual MCP registry
implementation has proceeded. Ensure both links now point to current, active
documentation or project locations.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 688160df-35ac-4763-b81f-fa8df98ffe2b

📥 Commits

Reviewing files that changed from the base of the PR and between cdf69d8 and d9b339d.

📒 Files selected for processing (1)

• architecture-decision-records/mlflow/ODH-ADR-ML-0001-consolidate-ai-asset-registries-on-mlflow.md