The Swappable Base.
PH—018
The foundation model is a commodity. We treat it like one. Here is the architecture that lets the base swap out — Opus to Sonnet, GPT-4 to Gemini, open weights fine-tune — without anything above it breaking.
I Why We Don’t Couple
A system coupled to a single foundation model inherits three liabilities. It is hostage to that provider’s pricing changes. It is hostage to that provider’s capability changes. It is hostage to that provider’s policy changes. All three have happened in the last two years, to every major provider.
The correct architecture treats the base model as a swappable dependency. We have shipped three base-model swaps across our install base without a single customer-visible interruption. The architecture that made that possible is the subject of this volume.
II The Abstraction Boundary
Above the base model sits a thin adapter layer. The adapter is responsible for three things: taking a normalized request from the rest of the system and rendering it into the current base model’s native format, taking the base model’s response and normalizing it back, and logging the round trip to the inspectability layer.
Everything above the adapter (the agents, the recommender, the ontology filter, the orchestrator) operates on the normalized format. They never see the base model directly. The base model can be any of the supported providers, or a self-hosted open-weights fine-tune, and the layers above do not know the difference.
III What Swaps, What Doesn’t
The base model swaps. Everything else is ours. The corpus does not swap. The ontology does not swap. The compounding loop does not swap. The customer’s own data does not move.
When a better base model releases, the swap is a configuration change. We run the regression benchmark, shadow the new model for a week, canary on two installs, then promote. Same four gates as a corpus refresh.
IV Real-World Swap · Claude Opus 4.5 to 4.6 to 4.7
In the last twelve months, we have swapped the majority of the install base between Opus 4.5, 4.6, and 4.7. Each swap ran the four-gate process. Each swap shipped with no customer-visible incident. Two swaps surfaced minor regressions in the agent layer that we patched inside the shadow window, before any customer saw the new model.
The swap cost was internal, not customer-facing. That is the point. A customer who installed Terrein in 2024 has had their base model upgraded twice without them having to do anything. The install gets sharper on its own cadence.