A city repo must stop silent default model upgrades from changing permitting answers. What configuration practice fits?

Permitting assistants must not change behavior because a platform silently floated to a new default model. Pinning the Claude model ID in settings so upgrades cannot silently change answers works because deterministic configuration keeps prompts, evaluations, and resident-facing guidance tied to a known model revision until the city deliberately upgrades and retests. Model pins support change control for high-stakes civic Q&A. Tracking prompt template version in source control for audit consistency fails because it audits prompt text but does not stop the model itself from silently changing, so permitting answers can still drift without a configuration pin. Monitoring token usage and latency trends in a central observability dashboard fails because it surfaces performance symptoms after the fact but does not prevent silent model upgrades from changing permitting answers before anyone notices. Archiving permitting decision outputs with timestamps for public records retention fails because it preserves a historical record of answers but does nothing to stop silent model upgrades from changing those answers in the first place. Exam caveat: pinning stops silent upgrades but does not remove the need to plan tested upgrades when Anthropic retires models or when evaluations show a better pin. Operational check: set an explicit model ID in repo or service settings, log the model ID on every permitting response, and require a change ticket plus regression evals before moving the pin.