Skip to content

MLOps Migration Checklist by Scale

Last updated: 2026-05-24

This page converts the S0-S5 MLOps scale model into migration gates. Use it when a team asks whether to add a tracker, data catalog, lineage graph, quality platform, registry, serving platform, orchestration platform, evaluation service, feature store, GPU scheduler, policy engine, release board, platform SRE owner, or platform team. The answer should follow artifact authority and operational risk, not tool ambition. For data-product contracts, catalog/lakehouse choices, lineage event boundaries, quality gates, retention, deletion propagation, and quality SLOs, use ../data-platform/data-catalog-lineage-quality-ops.md. For registry identity, aliases, lifecycle states, artifact-set membership, and rollback retention, use model-registry-artifact-lifecycle-by-scale.md. For batch inference, online endpoints, edge runtime packages, service manifests, traffic splits, autoscaling, and ODD-cell canaries, use serving-inference-operations-by-scale.md. For platform service criticality, SLOs, error budgets, backup/restore, DR, incident lanes, tenant isolation, and bypass controls, use platform-sre-reliability-by-scale.md. For orchestrator selection and workflow-state design, use pipeline-orchestration-release-workflows-by-scale.md; for metric specs, evaluation manifests, replay gates, runtime package checks, and shared evaluation-service SLOs, use evaluation-platform-replay-gates-by-scale.md.

The core rule is: contract first, platform second. A team should not buy or build S5 infrastructure to compensate for missing S1 reproducibility, and it should not ship S2 production models without release evidence just because training is automated.


How to Use This Checklist

  1. Identify the artifact authority: research-only, baseline, production candidate, fleet rollout, safety-critical release, or shared platform service.
  2. Find the highest authority level in the artifact set. A single semantic map, labeler, runtime engine, or prompt pack can raise the required scale even if the team is small.
  3. Apply the transition checklist before migrating tooling.
  4. Preserve the manifest/interface from the previous scale so migration adds control without breaking reproducibility.
  5. Measure the migration with the scorecard in mlops-scorecards-and-kpis-by-scale.md and the run-authority/reproducibility contract in experiment-tracking-reproducibility-by-scale.md.

Do not treat scale as a vanity maturity score. A research team can stay S1 for months. A small airport, yard, campus, or warehouse fleet can require S4 controls for one map publication or safety-relevant model release.


Migration Principles

PrincipleMeaningFailure it prevents
Artifact authority beats team sizeRequired controls follow what the artifact can changeSmall teams shipping unsafe production models
Interfaces survive tooling changesJSON/Markdown manifests can later become registry/catalog recordsReplatforming loses lineage
Automation produces evidence, not approvalPipelines can create artifacts and reports; humans/policy approve promotionGreen job silently becomes deployment
Rollback is part of migrationEvery new scale must preserve a known-good pathUpgrade creates unrecoverable release state
Local ODDs matterFleet scale means site/ODD cells, not only vehicle countGlobal metrics hide local failures
Shared platforms need SLOsCentral services must be faster and safer than local bypassPlatform becomes ignored
Policy starts narrowEnforce the highest-risk artifact boundary firstBroad policy blocks useful work and causes shadow pipelines

Scale Entry and Exit Criteria

ScaleEnter whenMinimum exit criteria before moving up
S0 notebook researchOne owner is exploring feasibilityResult has code commit, data pointer, config, metric, limitations, and decision note
S1 repeatable prototypeAnother engineer must reproduce or compare a resultFrozen split, environment/container, deterministic script, baseline metric, failure examples
S2 single-product productionArtifact reaches a customer, operator, vehicle, map release, production label set, or serviceRegistry version, release packet, offline/replay gates, runtime package test, rollback target
S3 fleet and multi-siteMultiple sites, routes, ODD cells, vehicles, hardware kits, or local operating modes divergeSite slices, local holdouts, ODD-cell release manifests, telemetry IDs, canary/rollback by cohort
S4 regulated safety-criticalFailure can affect people, protected assets, regulatory evidence, safety case, or incident reportingClaim/evidence table, immutable evidence, approvers, waiver expiry, rollback drill, retention hold
S5 platform scaleMany teams/products share data, compute, labels, evals, registries, or governanceTenant isolation, policy-as-code, audit API, platform SLOs, cost allocation, exception workflow

Exit criteria are cumulative. S3 does not remove S2 release packets; it adds site/ODD scope and fleet observability. S5 does not remove product accountability; it standardizes the platform contracts.


S0 to S1: Research to Repeatable Prototype

Trigger: A result is reused in a decision, benchmark, proposal, roadmap, or comparison.

Checklist itemRequired output
Move from notebook-only state to scriptable runtrain/eval command or equivalent reproducible script
Record data identityData pointer, sample manifest, split definition, excluded data
Freeze environmentDependency lock or container image digest
Record configurationVersioned config, random seed, preprocessing settings
Assign run authorityscratch_run, exploratory_run, or baseline_run state plus required reproducibility level
Produce deterministic metric outputMetric table, confidence interval if applicable, failure examples
Preserve limitationsODD, input modality, label caveats, known missing slices

Do not add yet: shared GPU platform, feature store, formal release board, multi-region deployment, heavy policy engine.

Exit gate: another engineer can rerun the baseline and explain why the result changed if it does.


S1 to S2: Prototype to Production Product

Trigger: A model, map, prompt/labeler, runtime package, or evaluation artifact can affect an operator, customer, vehicle, production label set, semantic map, or release evidence.

Checklist itemRequired output
Introduce registry identityImmutable model/map/labeler/eval/runtime artifact version, digest, authority state, aliases, and artifact-set membership
Add release packetClaim, evidence, limitations, rollback, approvers
Freeze datasets and labelsDataset manifest, label QA, leakage check, allowed-use state
Package runtime artifactONNX/TensorRT/container package, serving manifest, load test, latency/memory report
Add replay/offline gatesHoldout metrics, scenario replay smoke, calibration/OOD checks
Add evaluation manifestEval authority state, evaluator version, metric spec, slice set, artifact-set hash, runtime package smoke, waiver state
Add controlled aliasescandidate, shadow, champion, rollback, quarantined semantics
Add secure artifact chainSignatures, SBOM/provenance, trusted-builder or CI identity, policy result
Add rollback proofPrevious compatible artifact set and cache state

Do not add yet: automated continuous retraining to champion, one-click fleet expansion, federated learning without the trigger policy in federated-privacy-preserving-training-policy-by-scale.md, generic online feature store.

Exit gate: the exact artifact can be deployed, observed, held, rejected, or rolled back without ambiguity.


S2 to S3: Product to Fleet and Multi-Site

Trigger: The same artifact family operates across sites, routes, ODD cells, vehicle kits, weather bands, map states, or local operational rules.

Checklist itemRequired output
Partition release scopeSite/ODD-cell manifest with route/task/weather/map-state boundaries
Add local holdoutsPer-site or per-ODD validation splits and replay packs
Add fleet telemetry IDsActive model/map/calibration/runtime/taxonomy/prompt IDs in events
Add trigger miningIncident, drift, rare-class, map-change, operator-flag queues
Add active-learning budgetsLabel budget by site, safety slice, rare class, and local drift
Add site canariesCanary by ODD cell, not only by fleet percentage
Add blast-radius queryAbility to isolate affected site/cohort/artifact version quickly
Add GPU and label capacity controlsQueue priority, owner/site tags, unit costs, assurance capacity

Do not add yet: one global champion for every site, platform-wide policy that ignores local ODDs, centralized label budgets with no site weighting.

Exit gate: a release can expand to one ODD cell, hold another, and roll back a third while preserving evidence.


S3 to S4: Fleet to Regulated Safety-Critical

Trigger: A release can affect people, aircraft, protected zones, false-free-space, FOD, regulatory evidence, safety-case claims, incident reporting, or contractual acceptance.

Checklist itemRequired output
Convert release claims to safety claimsClaim/evidence table and safety-case IDs
Lock evidenceImmutable release packet, raw/replay logs, approvals, retention hold
Add hazard-focused replayRequired scenarios, incident regressions, false-free-space/personnel/FOD slices
Add waiver governanceOwner, expiry, residual risk, mitigation, revalidation trigger
Add dual approvalSafety/release authority separate from model author
Add rollback drillTime-bound rollback proof under active runtime/map/calibration
Add reportability pathIncident classification and evidence freeze workflow
Add trusted-builder controlsProvenance, signature verification, policy-gated release artifacts

Do not add yet: automatic release approval from scorecards, online learning without explicit gates, expired evidence reuse.

Exit gate: the release can be defended after an audit or incident with immutable evidence and named accountable owners.


S4 to S5: Regulated Product to Shared Platform

Trigger: Multiple product teams, model families, sites, tenants, or foundation-model workflows reuse data, compute, labels, evals, registries, and policy services.

Checklist itemRequired output
Standardize durable interfacesDataset, training-run, model, compatibility, evaluation, replay, deployment, incident, and attestation manifests
Add tenant isolationIAM, data partitions, registry namespaces, quota and cost allocation
Add policy-as-codeRelease blockers for registry aliases, data access, attestation, eval, and deployment
Add platform SLOsQueue wait, registry availability, eval lead time, incident lane, support response
Add audit APIQuery artifact lineage, active deployments, exceptions, evidence completeness
Add self-service templatesGolden paths for S1 baseline, S2 release, S3 site rollout, S4 evidence packet
Add exception workflowOwner, scope, expiry, compensating control, review cadence
Add platform scorecardAdoption, bypass attempts, cost, policy pass/fail, evidence completeness, user friction

Do not add yet: platform mandates without product-owner accountability, shared services that erase local ODD context, policy that cannot express safety exceptions.

Exit gate: teams can move faster through approved paths than through shadow infrastructure, while release authority and safety accountability remain intact.


Workstream Migration Matrix

WorkstreamS0-S1S2S3S4S5
DataManifest and fixed splitImmutable dataset snapshotSite/ODD catalog partitionsEvidence lock and legal/safety holdMulti-tenant catalog and lineage graph
LabelsInstructions and examplesQA states and allowed-useSite-sliced reviewer metricsExpert review for hazard labelsShared label platform with policy
ComputeWorkstation or rented GPUScheduled jobs and owner tagsShared queue and priority lanesReserved assurance capacityMulti-tenant scheduler and FinOps
RegistryCheckpoint folderVersioned registry and aliasesSite/channel metadataImmutable approval and retentionRegistry policy and audit API
EvaluationValidation scriptEvaluation manifest, holdout/replay/runtime smokeLocal holdouts, replay suites, shadow/canary evidenceSafety-case claim evidence, hazard replay, waiver expiryShared eval service with adapters, scenario catalog, and SLOs
Deployment and servingManual artifact or local batch jobServing manifest, shadow/canary/rollbackODD-cell rollout and site-scoped routingControlled safety release and rollback drillProgressive rollout platform with endpoint SLOs
MonitoringFailure notesDrift/runtime/latency metricsFleet anomaly and delayed labelsReportability and evidence freezePlatform observability SLOs
GovernancePeer reviewRelease ownersSite/ODD release ownersSafety authority and approversPolicy-as-code plus exception board
SecuritySecrets outside notebooksSigned artifacts and SBOMSite/tenant IAMTrusted builders and retentionAttestation service and admission policy
CostRun noteCost per run/label/replaySite chargeback and queue waitAssurance capacity accountingUnit economics by tenant/product

Tooling Upgrade Triggers

ToolingAdd whenAvoid when
Experiment trackerTwo people compare runs, a baseline must be preserved, or a candidate needs run authority/reproducibility evidenceSingle throwaway exploration
Data versioning/catalogDatasets influence baselines, labels, replay, evaluation, semantic maps, release evidence, or downstream consumers need snapshot identity and allowed-use stateRaw samples are exploratory only
Lineage and quality platformRoot cause crosses pipelines, data products need promotion gates, or invalidation must find downstream consumersA validation script plus manifest is still sufficient and no release authority exists
Pipeline orchestratorSteps repeat across candidates, artifacts need lineage, or release/evidence workflows need explicit statesOne-off preprocessing dominates
Model/artifact registryA model, runtime package, map, labeler, evaluator, replay pack, or adapter can be deployed, shadowed, rolled back, or consumed by another systemCheckpoints are local research only
Serving platformBatch jobs, endpoints, shadows, canaries, or edge packages need a shared service contract, rollout policy, autoscaling, telemetry, and rollbackLocal inference has no production client and no release authority
Feature/embedding storeDerived representations are reused across teams, retrieval, mining, or evidenceOne model owns a local feature file
GPU schedulerJobs compete for accelerators or incidents need priorityOne user rents occasional GPUs
Policy engineManual gates miss required fields or many teams share release pathsRequirements are still changing daily
Attestation serviceArtifacts cross release, runtime, OTA, map, or safety boundariesChecksums are enough for local prototype
Eval serviceMultiple teams duplicate replay/eval infrastructure, release candidates need ODD-cell manifests, or replay/runtime/shadow evidence must be policy-checkedOne product has a small local script and no release authority
Platform SRERegistry/eval/serving/orchestration outages can block release, rollback, incident response, or audit reconstructionServices are research-only and have no release authority
Platform teamShared services need SLOs and supportTool ownership is still part-time and local

30/60/90 Migration Plan

WindowFocusDeliverables
First 30 daysStabilize interfacesDataset/run/model/eval manifests, current-state audit, baseline reproduction, owner map
Days 31-60Add gates at artifact boundariesRegistry aliases, release packet, compatibility manifest, attestation, rollback proof, local scorecard
Days 61-90Scale scope and operationsSite/ODD release manifest, canary telemetry, trigger mining, queue/cost controls, incident linkage

For S4/S5 migration, extend the plan with evidence-retention design, policy-as-code rollout, tenant isolation, audit API, exception workflow, and platform SLO review. Do not attempt all product teams at once; start with one artifact family and one release path.


Airside and Non-Road Managed-Site Notes

MLOps migration in non-road autonomy should account for sites that are physically bounded but operationally diverse:

  • Airport stands, terminal frontages, service roads, warehouses, ports, campuses, construction areas, and mine sites each need local ODD cells.
  • A semantic-map release can require S4 evidence even if the fleet is small because false permanent structure, missed personnel, or wrong free-space can affect safety.
  • Map-derived labels must not move from S1/S2 experiments into S3/S4 training without source-map acceptance, release-state masks, taxonomy compatibility, and invalidation policy.
  • Site terminology belongs in labeler/prompt registries; it should not fork the core class taxonomy without promotion review.
  • Migration should preserve site operations ownership. Platform automation cannot decide local route, weather, work-zone, or aircraft-proximity acceptance by itself.

Migration Evidence Packet

Before declaring a migration complete, attach:

EvidencePurpose
Current-state auditShows which controls already exist and which are missing
Artifact inventoryLists models, maps, prompts, evals, datasets, replay packs, and runtime packages by authority level
Registry lifecycle sampleShows one artifact moving through candidate, shadow, site_canary, champion, rollback, or quarantined without losing evidence or scope
Interface manifest setProves durable contracts exist before platform migration
Evaluation manifest sampleProves the new path can compare candidate and baseline artifacts with evaluator, metric, split, replay, runtime, waiver, and decision identity
Scorecard baselineMeasures reproducibility, data quality, release readiness, observability, cost, and governance
Risk registerNames failure modes, owner, mitigation, and accepted residual risk
Rollback planDefines previous scale fallback and known-good artifacts
Adoption planNames teams, training, templates, support channel, and exception process

The migration is not complete when the tool is installed. It is complete when a real artifact passes through the new path, produces evidence, and can be rolled back or rejected cleanly.


Failure Modes

Failure modeConsequenceControl
S5 platform before S1 reproducibilityExpensive infrastructure preserves bad habitsRequire run/data/config manifest before platform onboarding
Pipeline automation before release contractTraining completion becomes release approvalSeparate build, evaluate, promote, deploy, and approve states
Registry without rollbackAlias movement looks mature but recovery failsRequire rollback alias and compatibility proof
Site scale with global metricsLocal ODD regression reaches productionODD-cell release manifests and local holdouts
Safety release with mutable evidenceIncident review cannot defend approvalImmutable release packet and retention hold
Policy engine too broad too earlyTeams create shadow pathsStart with high-risk artifact boundaries and clear exceptions
Platform SLO ignoredCentral service slows product teamsMeasure queue wait, eval lead time, support time, and bypass attempts
Migration erases local ownershipPlatform team becomes accidental release authorityKeep product/site/safety owners on approval records

  • mlops-scale-research-scope.md - maturity ladder and research scope.
  • mlops-reference-architectures-by-scale.md - concrete S0-S5 architectures and durable interfaces.
  • mlops-scorecards-and-kpis-by-scale.md - migration scorecards and release blockers.
  • experiment-tracking-reproducibility-by-scale.md - run authority states, reproducibility levels, manifest fields, and tracker architecture tradeoffs.
  • model-registry-artifact-lifecycle-by-scale.md - registry records, alias authority, lifecycle states, artifact-set membership, and rollback retention.
  • serving-inference-operations-by-scale.md - serving modes, service manifests, platform selection, traffic routing, autoscaling, ODD-cell canary, and rollback controls.
  • platform-sre-reliability-by-scale.md - platform service criticality, SLOs, error budgets, backup/restore, DR, tenant isolation, and incident lanes.
  • pipeline-orchestration-release-workflows-by-scale.md - orchestrator choices, workflow state machines, artifact handoff contracts, and release/evidence gates.
  • evaluation-platform-replay-gates-by-scale.md - evaluation manifests, metric specs, replay gates, runtime package checks, shadow/canary evidence, and platform service SLOs.
  • model-governance-release-evidence.md - release packets, aliases, and rollback evidence.
  • site-sliced-release-evidence-by-scale.md - ODD-cell release manifests and local rollout gates.
  • feature-embedding-store-ops-by-scale.md - store migration triggers.
  • gpu-queueing-finops-by-scale.md - compute migration triggers and unit economics.
  • secure-artifact-attestation-profile.md - artifact trust-chain migration gates.
  • federated-privacy-preserving-training-policy-by-scale.md - trigger policy before adding federated or privacy-preserving training lanes.
  • ../data-platform/fleet-data-pipeline.md - data-platform posture by MLOps scale.
  • ../data-platform/data-catalog-lineage-quality-ops.md - data-product contracts, lineage/quality platform triggers, promotion states, SLOs, and deletion propagation.
  • ../../40-runtime-systems/ml-deployment/av-cicd-devops-pipeline.md - CI/CD and deployment lane architecture.

Sources

Public research notes collected from public sources.