Model cards as source of truth, not afterthought

Most teams treat the model card as a write-once document. We treat it as a versioned object — every commit creates a new immutable version, and the registry keeps the full diff history. Audits run against a specific version, never "the latest", so a re-audit reproduces exactly.

We also wire a peer-review agent in front of every submission. It checks the card against a quality rubric (intended use stated? evaluation data described? limitations enumerated?) and blocks the registration if anything's missing. You can bypass with ?force=true in CI for known-good migrations, but the default path is a thoughtful, agent-reviewed card.

This sounds bureaucratic. In practice the agent's review takes a few seconds and the feedback is usually actionable: "you didn't describe the evaluation data". Most engineers find it less annoying than a human reviewer who shows up a week later asking the same question.