1:1 mentoring with Big Tech AI engineers
System Design

Migrations & Rollouts

Four migrations that scare an AI team (provider swap, monolith to agent, model version, vector-store swap), each run as shadow, canary, ramp and rollback-ready, with the one difference from classic migrations: equivalence is an eval score on a golden set, not a byte diff.

Last updated

After this section you can

  • Choose the eval gate that proves a provider swap, a model upgrade or a store swap safe
  • Trace the request-level changes a same-family model upgrade makes
  • Explain the trap in each migration type, and why the record gets a dated revisit
44

Migrations & Rollouts

Four migrations that scare an AI team, each proven safe by an eval score on a golden set rather than a byte diff.

Key idea

Outputs are probabilistic, and a 200 OK can hide a quality drop. So the equivalence test is an eval score on a golden set, a frozen set of graded real cases, not a byte diff. Each migration climbs one ladder, and the gate catches its trap.

Four migrations, one ladder: the eval gate catches each trap
MIGRATION SHADOW EVAL GATE CANARY, RAMP ROLLBACK-READY a small live slice, then ramp in steps Provider swap mirror a sample, score both × schema drift strict parse fails it flag back to 0% Monolith to agent one intent, shadow first × fallback masking count the fallbacks fall back to the monolith Model version re-tuned prompt, golden set × over-refusal its own slice, per intent keep the old model ID Vector store dual-write, shadow-read × a half-built index recall at parity read-flag flip, dual writes The gate is per slice, against its noise band: one failing slice stops the ramp before live traffic sees it.

Red names the trap that each gate has to catch. Pans sideways on a phone.

Related

More in System Design

Get full access to all 149 sections with code examples, diagrams, and interactive animations.

Unlock Premium