模型路由：系统设计
通过声明的能力、数据处理政策和成本预算选择模型，并明确禁止回退路径，以确保敏感或高保障请求绝不会悄无声息地降级到不允许的层级。
Requires model responses to conform to a declared schema with distinct handling for parse, schema, and semantic failures, plus a bounded repair loop that cannot retry indefinitely or silently drop required fields.