I keep watching models go false without throwing an exception, because promotion day was treated like a permanent blessing.
Everyone treats promotion day like the end of model risk. The ranges looked honest: this book leans on conformal prediction throughout, a way of turning a raw point forecast into a range built from calibration data so that, if the calibration set and the live data are drawn the same way (the "exchangeability" assumption below), the true value falls inside the range a target fraction of the time, say 90 percent. "Coverage" is simply how often that promise actually holds once you check it against reality: a range built to cover 90 percent that only covers 70 percent of live outcomes has broken its certificate even though nothing crashed. The replay pack passed. Tiny size was allowed. Then weeks later the model is false without throwing an exception. No stack trace. No red build. Just a quiet mismatch between the world the certificate assumed and the world that arrived.
Distribution shift is the polite name. Under the hood the joint law of features and outcomes moved. Exchangeability assumptions that made coverage stickers honest stopped holding. A range that was ninety percent last quarter can be sixty percent this month while dashboards stay politely yellow. Adaptive conformal prediction (Gibbs and Candès, ACI, arXiv:2106.00170) and anytime-valid inference / e-processes (Ramdas, Ruf, and coauthors) exist because static certificates expire. The math is not optional once you allow autonomy to spend.
I care about this because frozen exams and multi-gate releases are necessary and still insufficient. They answer Friday negotiation. They do not answer Tuesday quiet decay. Quiet decay is worse than loud failure because loud failure creates tickets. Quiet decay creates confidence. People point at last month's promotion pack while this week's coverage is already soft and this week's hosted model is already a stranger.
Three clocks that desynchronize
Market clock. Regimes move. Co-break weeks arrive. Correlations that set hedge ratios drift. Path budgets calibrated on calm worlds stop describing live stress.
Data clock. Vendors revise book. Schemas change. Feature jobs pick up new defaults. As-of contracts rot when sources change behavior under the same id.
Model clock. Hosted models and foundation APIs update under you. Registry hashes for your wrapper stay still while the hosted behavior becomes a ghost candidate. You do not own this clock, which is exactly why it must be instrumented first if you only instrument one.
When the three clocks desync, conformal coverage, residual honesty, and crowd width can all go soft without a single exception. Yellow dashboards train people to ignore yellow. Fluent agents reopen the 1.80 temptation on CEH-001 while tiny size is still on.
How this shows up when people still trust the certificate
- Model trench. A promoted crowd is a lease, not a monument. Parameters estimated on last quarter's window can move marks by a third of the frame gap after a rolling retrain. Frozen recipes are not frozen models. Freezing the recipe means the transformation is stable; it says nothing about the object the transformation produces when inputs move.
- Agent trench. Agents that cite last month's promotion pack as if it were today's truth are performing certificate theater. Clearance tokens that cannot expire are not Clearance. They are permanent rights wearing a polite name.
- Harness trench. Monitoring that cannot turn autonomy off is journalism. Meeting-shaped kill switches turn yellow into red P&L because revoke required consensus. Canary without a pre-agreed breaker is demo theater.
- Pipeline trench. Silent provider updates. Silent vendor schema drifts. Silent retrain windows called "maintenance." Each is a change without a change packet. CHANGE_PACKET_MISSING is the refuse that should have fired before confidence calcified.
A CEH-001 week that looks ordinary until it does not
| Week | Dual marks | Coverage / residual | Autonomy state |
|---|---|---|---|
| 1 (post-promote) | ~1.50 [1.42, 1.58] / ~2.10 [2.01, 2.22] | coverage ~0.90 nominal | tiny size on |
| 2 (hosted swap) | same ids; drafts drift | ghost candidate under same wrapper hash | midpoint drafts rise; fluency up |
| 3 (co-break) | gap may widen live | co-break coverage 0.90 to 0.70; residual soft | war room proposes 1.80 "temporary peace" |
| Denied mid | 1.80 still outside both honest bands | if breakers need a meeting, size stays on | |
| Frame gap | 0.60 (centers); empty corridor 1.58 to 2.01 | not a social average problem | |
| Re-registration | mark moves 0.18 on the 0.60 gap -- 30%, past the quarter-gap (0.15) threshold | forces exam re-registration; clean weeks widen autonomy via the staged ladder (Chapter 27), never a flip switch | |
Over-coverage can also be a lie. When the model partly determines outcomes through its own prints, coverage can print above nominal and look conservative. That signature belongs to the feedback post. Here the point is simpler: monitors that only alarm on under-coverage will miss whole classes of live failure.
Why promotion-day thinking fails
Promotion answers: did this candidate pass a frozen exam under named worlds? Live risk asks: is the lease still valid under today's market, data, and model clocks? Treating the first answer as permanent is how thin governance re-enters a thick-looking machine. Specification gaming of monitors is real too: if yellow is costly socially and green is rewarded, people will tune thresholds until yellow dies. Threshold ownership must be explicit and change-packeted.
Research fact that belongs in the trench
Concept-drift and continuous-monitoring literature keeps separating two certificates people collapse: the offline exam pass and the online exchangeability assumption that made coverage numbers honest. Adaptive conformal methods (Gibbs & Candès ACI, arXiv:2106.00170; Angelopoulos & Bates tutorials) exist because that assumption fails in time. Anytime-valid inference and e-processes (Ramdas et al.) let you peek continuously without spending the type-I budget the way fixed-horizon tests do. The desk mistake is to treat adaptation as permission to widen forever. A range that covers everything by becoming the whole real line is not stakeable uncertainty. It is a surrendered claim.
Hosted foundation-model change detection is the other modern fact. Your registry hash can stay virtuous while the remote behavior becomes a ghost candidate. Decision-level probes on fixed CEH-001 jobs (dual-frame drafts, midpoint refusal, as-of legality) catch what uptime checks miss. Clearance leases must list those probes. Promotion day is the start of the lease, not the end of model risk.
What to lock before autonomy is a lease
- Monitors that can revoke tokens without a meeting.
- Named breakers with owners: coverage, residual, crowd-width, provider-behavior, data-contract.
- A small trusted set over a museum of ignored alerts.
- Change packets for retrains, provider updates, and vendor drifts.
- Promotion treated as a lease with monitors attached, not a permanent blessing.
- If you only instrument one clock, instrument the one you do not own: hosted model updates.
- CEH-001 dual marks stay dual; 1.80 is never temporary peace while size is on.
If that feels too cautious for the demo calendar, the demo calendar is the risk. Next post: the stack that makes expiry physical.
Book: Chapter 26 in Rulers Before Models.