Model Versioning and Rollback in Production

`latest` is an incident waiting for a calendar

Floating aliases move when providers update. Tool-calling JSON breaks, latency shifts, refusals soften—and your config still says `gpt-4o`. Model Governance means an explicit `model_id` (or fine-tune checkpoint) per environment, logged on every request, with a practiced path back to the previous pin.

One app trusted an undated alias. A provider change broke schema adherence; they could not select "yesterday's" revision and burned hours retuning prompts. Explicit pins plus a canary router stopped the repeat.

Canary, then pin

eval suite green → route N% to new model_id → watch latency/errors/quality → promote or revert flag

Change model and prompt in the same untested deploy only if you enjoy inseparable root causes. Prefer one variable at a time. Fine-tunes follow the same rules—more strictly: each checkpoint needs eval evidence and an owner who may promote it.

Rollback that meets RTO

Rollback should be a config or feature-flag flip when possible—not a full monolith rebuild. Keep a runbook: who approves model changes, how to revert, where dashboards slice by `model_id`. If the provider only offers aliases, map a stable internal ID through your proxy to a revision you control.