Model delivery

On-Device Model Update and Rollback

Keep the working artifact until the candidate is verified and loadable.

Last reviewed: 2026-09-16 · Fact IDs: COVE-DOWNLOAD-01, COVE-LIFECYCLE-01

Direct answer

A model artifact is release infrastructure. Its source, revision, length, digest, temporary state, update path, and repair path must be reproducible.

This page does not publish benchmark or compatibility results. It shows the evidence required to answer on-device model rollback without turning an assumption into a product claim.

Evidence to collect

The claim becomes reviewable only when the following evidence is attached to the same artifact and test run:

  • Old and new manifests
  • Switch transaction
  • Rollback test

A completed byte stream is not enough. Final placement, integrity, runtime load, and recovery must also pass.

Implementation workflow

  1. Pin the official artifact revision.
  2. Record expected length and trusted digest.
  3. Check storage for temporary and update copies.
  4. Download to a temporary path and resume safely.
  5. Verify before final placement.
  6. Keep rollback and repair paths.

Keep each transition observable. A failure should identify the stage, artifact, runtime, and recovery action without logging private user content.

Failure patterns to prevent

  • Replacing before verification
  • No artifact version in user state

Also prevent silent fallback, unpinned artifacts, missing cancellation, and conclusions that combine unlike configurations. Store unsuccessful runs alongside successful ones.

Minimum reproducibility record

LayerRecord
DeviceManufacturer, model, chipset, RAM class, operating-system build
SoftwareApplication version and git commit
ModelFamily, variant, revision, format, file length, hash, quantization
RuntimeName, revision, requested backend, observed backend evidence
WorkloadFixture revision, input hash, prompt hash, output policy
OutcomeCompleted, failed, cancelled, fallback, and privacy-safe diagnostics

Release checklist

  • ☐ The primary query is answered without an unsupported number.
  • ☐ Every artifact and runtime is pinned.
  • ☐ The representative task and failure policy are explicit.
  • ☐ Lifecycle, cancellation, cleanup, and fallback are tested.
  • ☐ User-content and network boundaries are documented.
  • ☐ Result wording applies only to the recorded configuration.
  • ☐ The page links to raw method or evidence when results are added.

Sources and related evidence

This page relies on the Cove fact ledger and benchmark policy. Results remain blocked until raw records exist.

Chinese deployment and troubleshooting content is organized in the 奇连 AI 端侧专题.