7/ Model fraud is ruled out the same way. The enclave's code binds each model family to its provider. A Claude request can go to Anthropic or the fallback of openrouter and nowhere else. Every response carries a signed routing receipt: the model you asked for, the provider it went to, the exact model id sent. Proven.