Model routing: System design
Selects models by declared capability, data-handling policy, and cost budget with explicit forbidden fallback paths so sensitive or high-assurance requests never downgrade to disallowed tiers silently.
Requires model responses to conform to a declared schema with distinct handling for parse, schema, and semantic failures, plus a bounded repair loop that cannot retry indefinitely or silently drop required fields.