The Model Changed Under You — a Multi-Vendor Drift Register That Warns You Before Your Customers Do

What you'll do

A standing multi-vendor model-drift programme you own end to end: a register that records, per vendor, the exact model identifier you are pinned to, the alias you are only watching, the deprecation policy you actually read and the date you read it; a frozen, hash-addressed corpus of your own real work and a hand-labelled golden table that outranks every model in the project; a robustness slice manufactured entirely offline by a local open model so real customer sentences never cross a vendor boundary just to become test data; a closed output contract with a deterministic validator that rejects a malformed answer before any comparison happens; a single audited send function that appends every outbound payload to a hash-chained ledger before it leaves, with a canary leak assertion that fails the run rather than the review; a measured same-day self-agreement noise floor, so your drift threshold clears real re-run variance instead of assuming it away; an arithmetic verdict computed from agreement rates you wrote down before you saw a number, never from a model's opinion of another model; a standing alternate from a different company scored on the identical corpus every cycle so a replacement is already measured on the day you need it; a scheduled watch with a hard cost cap and an alert you have personally seen fire; five drills you have actually run — a retired identifier, an alias moving under you, an unreachable alternate, a broken contract, and a corpus row that tries to talk your classifier out of its own categories; and a signed migration runbook with a shadow window, a rollback trigger, and a named human who owns the decision.