Kaaval checks every model answer against an explicit contract before it ships, escalates to a stronger model only when verification fails, and stores a replayable receipt for every decision — provider, cost, tokens, and exactly which checks passed.
Deterministic contract checks — JSON shape, required fields, enums, numeric ranges, policy caps like refund_amount_usd ≤ 500. No model judges another model inline.
Only a failed answer pays for a stronger model. The rescue is checked by the same contract — malformed output from the expensive tier fails too.
Every attempt is stored as a replayable, source-tagged receipt: provider, cost, tokens, latency, and which checks passed or failed.