[obvious-autobuild]

What changed and why

Integrates the recipe-catalog slices into one shippable state, on top of the loader PR's branch (obv/burst5-fridgeluck-rcp-loader):

• Ships the compiled bundle. apps/ios/Resources/RecipeCatalog/recipes-v2.json — 762 recipes (rcp-000167–rcp-000934), 328 ingredients, sha256 96d9896a…d8439, 2,600,354 bytes. Corpus: PR Rights-approved recipe corpus: 401 originals behind FSIS safety, rights and claim gates #113's 401 recipes + the world packet (PR feat(data): add world-2026-10 recipe originals packet (179 recipes) #164, 176/179 ingested) + the everyday packet (PR feat(data): add everyday-2026-10 recipe slice — 24 originals + 161 RS v1 rewrites #163, 24 originals + 161 re-authored legacy-feat(data): expand bundled recipes to 327 and add bundled-data validator #144 rewrites). The app target's existing resource glob picks it up with no project.yml change; the loader prefers it over legacy data.json at launch.
• Packet ingestion (data/recipe-bundle/ingest_packets_2026_10.py + mapping at data/recipes/evidence/ingest-2026-10-map.json): packet ids renumbered into the corpus's fl-original-* band (the compiler derives catalog ids from the id suffix — packet suffixes would collide), rights manifests converted to the main shape with evidence pointing at the packet files and commits. Three world recipes were excluded, never retitled or re-authored — "Egg Drop Soup" and "Chicken Enchiladas Rojas" are normalized-title collisions with existing corpus dishes that are different recipes (dedupe gate), and "Curry Goat" failed the fail-closed FSIS gate (the chart has no goat row, so its protein cannot be verified); all three exclusions are recorded in the mapping file.
• Vocabulary rebuilt additively with the pipeline's own build_vocab.py: 329 keys, 555 surfaces, +97 FDC rows. per_100g/fdc_id unchanged for all 220 pre-existing keys (verified); 97 new world-cuisine keys carry honest partial nutrition coverage rather than synthesized values.
• Manifest and validation report under data/recipe-bundle/: provenance, contents (rights 460 original / 302 quarantined, nutrition 163 computed / 345 estimated / 254 partial, 255 step timers), and every command run with its result.
• End-to-end tests (Tests/Integration/RecipeCatalogIntegrationTests.swift) reading the shipped bundle from Bundle.main, not a fixture: full hydration with lines/steps/nutrition and resolvable ingredient keys, launch idempotence, v18-upgrade history preservation with no false legacy links, RecommendationEngine.findRecipes over fixture pantries with honest fit lines, and the catalog read path serving structured content.
• Review-fix round (2026-10-15, head 0ba4be1) — all five findings from review comment 6199645081 addressed:
  1. Bundle-validator fail-open claims (fixed). The diet-claim and FSIS audits read a nonexistent singular class field (the vocabulary carries a plural per-key classes list), and the vegan blocker named a class (dairy_egg) that does not exist — so the gates could never fire. Reproduced before fixing: seeding vegetarian: true on rcp-000177 (contains chicken_breast) returned PASS. Now the audits read the real classes: claims fail on expressible composition contradictions (vegetarian blocks meat/fish/shellfish — the vocabulary's animal entries are ghee, honey, mayonnaise, which are lacto-ovo-vegetarian-acceptable; vegan additionally blocks animal/dairy/egg/honey), thermometer endpoints stay meat/fish-gated, and claim lines with no known vocabulary classes are disclosed as warnings, not silently passed — the corpus-side composition gate remains the fail-closed authority (verified green: 762 recipes, 0 unchecked claims). Verified after fixing: the shipped bundle PASSES with 32 disclosed warnings, and the same seeded vegetarian-on-chicken mutation now FAILS naming the contradiction.
  2. Release-gate 367 errors on the committed tree (fixed). Root causes: rights records for the 361 packet-ingested recipes were looked up by their re-keyed corpus ids only (now matched by packet source_ref first with id fallback), packet evidence wasn't pinnable at its recorded commits (now pinned via extended rights_evidence.py/pin_rights_evidence.py), and the validator needed suite inputs that weren't in the tree (the corpus's authoring-era 26c7004 suite is now committed under data/recipes/suite/, separate from the packet's 9d3a704 suite under the packet's src/). The five food-safety failures were fixed at the recipe level (thermometer checks on Chicken Kyiv, Bigos, Leczo; an unsupported internal-temperature claim removed from Koose) or excluded fail-closed (Curry Goat). Release gate on the committed tree: VALIDATION GREEN — 762 recipes, linter 401/401, 0 unchecked claims, 94.48% quantity resolution, 14/14 bands, rights-clear.
  3. Byte-identity test needing operator /tmp inputs (fixed). The test ran build_vocab.py, which reads pinned external downloads that cannot be committed (USDA FDC bulk CSVs, canon). It now proves the property that matters on a fresh clone: the committed build copy equals a fresh compile_bundle.py output byte-for-byte. Vocabulary-rebuild determinism remains as a separate check that skips unless the operator has the pinned inputs.
  4. Missing packet-checker modules on a fresh clone (fixed). bands.py, rs.py, rights.py, allergens.json, pinned canon, and the FNDDS portion evidence are committed under the packet's src/; the checker now runs from a clean checkout and PASSES (179 records; all 14 previously planted mutations still caught during development).
  5. Python CI absent (fixed). New .github/workflows/python-ci.yml runs on every PR: the pipeline + gate test suites, the corpus release gate, the world packet checker, bundle validation, and byte-identity (fresh compile must equal the committed build copy). First hosted runs exposed two more fresh-clone gaps, fixed in follow-ups: the gates' suite loader now reads the committed pinned suite first (c6d94cb), and the reproducibility gates' pinned revisions (corpus era 4b6e163, originals rights 607ef99, packet commits 1733f5f7/68c164de) are fetched by sha in the workflow so the pins stay real revisions, not in-tree copies (edb6975).
• Merged the pipeline and packet branches into this branch so corpus, compiler, vocabulary, and bundle are self-consistent.

How I checked it

Fix round (head 0ba4be1), all run on the committed tree:

• python3 -m pytest data/recipes/tools/tests/test_pipeline.py data/recipes/tools/test_gates.py -q → 68 passed, 1 skipped (the skip is the operator-only vocabulary-rebuild determinism check).
• Seeded-negative control on the claim audit: vegetarian: true on rcp-000177 → FAIL (1 problem): claims vegetarian but line 'chicken_breast' has class(es) ['meat']; clean bundle → PASS with 32 disclosed warnings.
• python3 data/recipes/tools/validate_corpus.py → VALIDATION GREEN (762 recipes, 401/401 linter, 0 unchecked claims, 94.48% resolved, 14/14 bands).
• python3 data/recipe-sources/world-2026-10/src/check_packet.py --quiet → PASS (179 records).
• python3 data/recipes/tools/validate_bundle.py → PASS (32 disclosed warnings).
• Byte-identity: sha256 of the build copy before/after a fresh compile_bundle.py → identical (96d9896acdaf7753…).
• Shipped resource == build copy (byte-compare), corpus 762 = bundle 762, test pin updated to 762.

Original round: ingest → 361 ingested / 3 excluded; build_vocab.py → 329 keys / 555 surfaces, nutrition fields stable on existing keys; GENERATED_AT pinned 2026-10-15T12:45:00Z per the compiler's recompile instruction.

What I could NOT check

• Nothing Swift was compiled or run locally (no toolchain in this environment). The test target's real compile is the hosted macOS CI on this PR. The bundle changed in this round (762 recipes), so the previously green macOS run at ac5a535 must be re-confirmed at 0ba4be1.
• iOS device behavior (bundle load timing, resource packaging on device) is unverified; CI's simulator suite is the evidence. The byte-identity step's diff-vs-HEAD semantics were verified by hand before its first run (CI checkout makes the worktree equal the committed head), and it passed on CI.
• iOS device behavior (bundle load timing, resource packaging on device) is unverified; CI's simulator suite is the evidence.

Hosted CI (macOS + Python)

• At ac5a535 (pre-fix): build-and-test PASS (run 38735419109) and dead-code-advisory PASS.
• First run at cbd3268 failed in the test suite: three loader-test failures plus one integration-test assertion — the branch was cut from loader 81bd03d while PR feat(ios): hydrate recipe bundle-v2 catalog with legacy fallback and revision history #151 gained the fixes upstream (72e5d96), and searchedIngredientCount reports the raw scanned set (0 for an empty pantry). Fixed by merging loader head and correcting the assertion.
• Fix round, final states at head edb6975 (all green):
  • macOS build-and-test PASS 7m28s and dead-code-advisory PASS 3m52s (run 38803890988).
  • python-ci (pipeline-tests-and-gates) PASS 22s (run 38803890897) — pipeline + gate tests, corpus release gate, world packet checker, bundle validation, and byte-identity all green on a fresh shallow clone.

Assumptions

• Legacy rows in data.json are kept, deliberately: the spec keeps legacy recipes readable through their existing ids, the loader's successor-link requires the legacy recipes row, and RecommendationEngine queries the legacy tables — the catalog layer has no recommendation query path yet. The everyday packet's 161 re-authored legacy-feat(data): expand bundled recipes to 327 and add bundled-data validator #144 rewrites ship as new catalog rows, not in-place successors; deleting the 166 legacy rows waits for migrated successors for all of them plus a catalog-backed recommendation path. Details in data/recipe-bundle/validation-report.md.
• Everyday categories stay packet-level metadata: the bundle-v2 collections enum (quick, budget, one_pot, comfort, use_soon) does not cover them; widening a spec-owned contract (PR feat(spec): recipe bundle-v2, ingredient identity, and taste-event contracts #148) is not an integration call.
• Claims with unknown vocabulary classes are disclosed, not blocked: the bundle-level audit catches contradictions expressible in the vocabulary; the corpus composition gate (fixture classes over ingredient names) is the fail-closed authority for claims, and it is green for all 23 claim-bearing recipes.
• Curry Goat excluded, not re-authored: the fail-closed FSIS chart has no goat row; substituting a different protein would re-author packet content, which the packet-ingestion contract forbids.
• Draft PR — not for merge without human review.
• Human author: Sam Gu (sgu07966@gmail.com).

🔗 Obvious Project · 🧵 Obvious Thread · 🔀 Obvious PR Artifact

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 314e91fd-476e-4c80-9e76-927266722e39

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[SamGu-NRX]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[obvious-autobuild]

Independent review (Obvious, Autobuild + Max)

Verdict: changes needed

The shipped bundle itself checks out: recipes-v2.json is byte-identical to a fresh double compile (87f4f2c1…99eb7f, 2,603,827 bytes), every manifest number I recomputed matches exactly (763 recipes / 329 ingredients, band rcp-000167..rcp-000934, coverage 163/345/255, rights 461/302, timers 258, all six cuisine counts), the two documented exclusions are real title collisions recorded in the ingest map, the ingest script refuses to re-run, and macOS CI is green at ac5a535 (run 38735419109: build-and-test 5m0s, dead-code-advisory 2m59s). The problems are in the gates around the bundle: two of the pipeline's own safety nets fail open or fail on the committed tree, and the Python suite is not reproducible from a fresh checkout.

Findings

1. HIGH — the bundle validator's dietary-claim and FSIS gates read a vocabulary field that doesn't exist, so claims validation fails open.
data/recipes/tools/validate_bundle.py:78 builds classes = {e["key"]: e.get("class") …}, but all 329 entries in data/ingredients/vocabulary.json carry classes (plural, a list) and zero carry class — so classes.get(key) is None for every ingredient. Evidence: I seeded vegetarian: true onto rcp-000177 ("Sunday Roast Chicken Salad Wrap", line chicken_breast) and the validator prints PASS; rebuilding the map as {key: set(entry["classes"])} and intersecting flags exactly that line (blocked = ['chicken_breast']). The same broken map drives the FSIS check at line 103 (has_protein is always False), so the "thermometer endpoints only on meat/fish recipes" gate can never fire as specified either. The shipped 23 claim-bearing recipes happen to contain no real claim/class collision (checked against the real classes data), so nothing bad is in this bundle — but the gate that exists to catch the next bad claim is decorative, and test_pipeline.py seeds violations for dangling keys and kcal but not for claims, which is why this survives. Smallest fix: at line 78 build {e["key"]: set(e.get("classes") or [])} and intersect at lines 91 and 103; add a seeded-claim violation test alongside the two existing seeded tests. (This is the same root cause flagged in the #158 pipeline review — it carried into this branch unchanged.)

2. HIGH — the committed corpus fails the pipeline's own release gate: 367 errors, covering all 362 ingested packet recipes.
pytest data/recipes/tools/test_gates.py::CommittedCorpus::test_release_gates fails on this PR's head with 367 errors: 362 × "no rights record" (every packet ingest, fl-original-0405..0768) plus 5 food-safety failures in world recipes (fl-original-0539 'goat meat' has no row in the FSIS chart; fl-original-0565 egg check is metadata only; fl-original-0566 and fl-original-0574 smoked sausage needs a thermometer check; fl-original-0581 step[2] states an internal temperature without a proper check). Root cause of the 362: validate_corpus.py:115 resolves rights as records.get(r.get("source_ref")) — the pre-integration corpus has source_ref == id (fl-original-0001), but ingested packet recipes keep packet refs (fl-world:gochujang-chicken-lettuce-wraps, …) while ingest_packets_2026_10.py keys the converted manifest records by corpus id: 0/362 lookups hit. data/recipes/evidence/rights.json (the pinned evidence the gate cross-checks) covers 0 packet recipes. Net effect: 362 of the 763 shipped recipes carry rights statuses that the pipeline's own standard — "nothing ships without verified affirmative evidence" — does not consider verified. Smallest fix: at ingest, also key the converted record under the recipe's source_ref (or make the gate fall back to the recipe id), regenerate pinned evidence for the packet citations, and fix the 5 world recipes through the packet's own checker. None of this changes the shipped JSON's bytes, but per the repo's own gates the bundle shouldn't ship while these fail.

3. MEDIUM — the byte-identity test cannot pass on a fresh clone; the manifest's cited verification is environment-dependent.
test_pipeline.py:115 (test_bundle_compiles_byte_identically) runs build_vocab.py first; that tool hard-reads /tmp/canon/identities.json and /tmp/fdc/… (build_vocab.py:12-13,42-43), which exist only in the authoring environment. On a fresh checkout: FileNotFoundError → the suite is 1 failed, 13 passed, not the "14 passed" manifest.json cites. The determinism property itself is real — compile_bundle.py twice from committed inputs reproduces 87f4f2c1…99eb7f exactly — but the test that proves it can't run here. Smallest fix: make that test compile-only (vocabulary.json is committed; the compile is the deterministic artifact), or commit/portable-ize build_vocab's inputs.

4. MEDIUM — the world packet's own checker can't even be imported from the committed tree.
check_packet.py:48 does import bands; no bands.py exists anywhere in the repo (it is also imported by ingest_originals.py:88 and validate_corpus.py:232 via an uncommitted suite dir). pytest data/recipe-sources/world-2026-10/src/test_check_packet.py errors at collection: ModuleNotFoundError: No module named 'bands'. The validation report says corpus-level linting "ran through the packets' own checkers" — that claim is not reproducible from this tree, and finding 2's five safety failures are exactly the kind of thing that checker exists to catch. Smallest fix: commit the suite modules (bands.py, plus the rights.py/rs.py that validate_corpus.py also expects) under the packet's src/.

5. LOW — none of the Python suites run in CI. .github/workflows only builds and tests the Swift app, so the green checks on this PR never execute test_gates.py, test_pipeline.py, or the packet checkers. Combined with the body's "How I checked" listing only the passing subset, a reader can't tell that the release gate fails on the committed tree. Suggest one line in the body naming the failing suites — and, better, a lightweight pytest job.

(Informational, no action needed: data/recipes/conversions.json is absent; load_corpus_conversions tolerates that by design and the report already discloses it.)

What I verified (commands and results)

• gh pr checks 162 → build-and-test pass 5m0s, dead-code-advisory pass 2m59s (run 38735419109 at ac5a535).
• python3 data/recipes/tools/compile_bundle.py twice → byte-identical output, sha256 87f4f2c1…99eb7f both runs; sha256sum of the shipped resource vs data/recipes/build/recipes-v2.json → identical (2,603,827 bytes each).
• Manifest cross-check against the shipped bundle: 763 recipes, 329 ingredients, unique ids rcp-000167..rcp-000934, coverage {computed 163, estimated 345, partial 255}, rights {original 461, quarantined 302}, timers 258, cuisines {asian 191, american 161, mediterranean 132, italian 105, mexican 98, indian 76} — all match manifest.json exactly.
• ingest-2026-10-map.json: 362 mapped; exclusions exactly fl-world-0043 "Egg Drop Soup" and fl-world-0147 "Chicken Enchiladas Rojas" (title collision) — matches the body.
• python3 data/recipe-bundle/ingest_packets_2026_10.py (dry run) on the integrated corpus → "refusing: packet ids already present in the corpus", exit 1 — idempotence holds.
• Suites: test_pipeline.py 1 failed / 13 passed (finding 3); test_gates.py 1 failed / 53 passed (finding 2); everyday checker test_check_everyday.py 23 passed; world test_check_packet.py collection error (finding 4).
• Claim/class audit with the real vocabulary data: 0 collisions among the 23 claim-bearing recipes.
• Revert-test: with corpus.jsonl reverted to the pre-integration 401-recipe version (from 7fc68d4), test_bundle_covers_whole_corpus fails (pin 763 vs 401) — the updated pin genuinely exercises this change; corpus restored afterward.
• Fail-open repro: seeded vegetarian: true on rcp-000177 → validator PASS; corrected lookup flags chicken_breast (finding 1).
• Read the new integration tests in full: they read the shipped bundle via Bundle.main, assert launch idempotence, the v18-upgrade history case, honest fit lines, and the empty-pantry raw-count assertion (searchedIngredientCount == 0) the body describes.

What I could not verify

• Anything Swift: no macOS toolchain here, so the integration tests were reviewed as source and their green state taken from hosted CI run 38735419109 (which passed) — consistent with the PR's own disclosure.
• The authoring-environment claims ("14 passed"; corpus linting "ran through the packets' own checkers") are not reproducible from the committed tree (findings 3–4).
• Bundle-size impact beyond file bytes, and GRDB 7 runtime behavior of the new tests beyond what CI covers.

Nothing here blocks the data itself — the bundle, manifest, mapping, and CI state are solid. Findings 1–2 are gate-integrity gaps that the repo's own contracts treat as ship-blocking, so changes needed before this leaves draft.