Pin the tool version a workflow was tested against

A workflow is tested against one shape of a tool reply, and a tool can change that shape without ever failing. The workflow then reads the wrong fields and the fault looks like a logic bug rather than a version change.

Record the tested version with the workflow

Store the tool version the workflow was tested against next to the workflow, not in shared config that drifts on its own schedule.

Check before the call, not after

Compare the deployed version with the pin before the call and flag a mismatch, rather than parsing a reply in a shape the workflow never saw.

def check(tool, pinned):
    if tool.version != pinned:
        return "mismatch"
    return "ok"

Upgrade on purpose

Move the pin only after the workflow is re tested against the new shape, so the change is a decision rather than a surprise.