[obvious-autobuild]

What changed and why

Two new files; no existing file is touched.

data/recipes/tools/safety_invariants.py — a Linux-side, read-only proof over the shipped bundle (data/recipes/build/recipes-v2.json) that the four per-recipe diet claims (vegetarian, vegan, gluten_free, dairy_free) never admit a recipe the app's HouseholdSafetyGate would block for a screened household. Five rules:

1. Claims are true only when proven. A shipped True claim must be True under compile_bundle.derive_claim over the lines' composition classes — imported from the compiler, one definition, never re-derived. The compiler keeps authored True claims it cannot verify (derive → None) and validate_bundle fails only true-vs-false contradictions, so a true claim over an unknown line ships silently today.
2. Vegan implies vegetarian and dairy_free (claim-lattice check).
3. Sweep: every recipe × every screened household — the gate's 10 allergen groups and 4 diets each singly, plus 11 pinned multi-restriction households. Claims speak only four languages (milk→dairy_free, wheat_gluten→gluten_free, vegetarian→vegetarian, vegan→vegan); households restricting anything else fail closed on the claim path, exactly like the gate fails closed. Keto never claim-admits (no class expresses keto; the gate limit is unset).
4. Thermometer coverage: a recipe with a raw meat/poultry/fish/shellfish/egg line that a step cooks carries a thermometer check. Ready-to-eat keys are exempt by name, each with a reason (canned tuna, sardines, anchovies, nduja, chicharrones, stocks/broth/fish sauce); raw tuna steak is deliberately not exempt.
5. Timer sanity: every timer within 1 s–12 h.

The gate tables mirror HouseholdSafetyGate.swift; a test parses that file's enum lines and fails on drift (including the keto limit no longer being nil, or the unknown-composition fail-closed screen disappearing). A recorded-but-never-decided advisory lists gluten_free recipes using oats, which the bundle classes as plain plant — certified gluten-free oats are Sam's call.

data/recipes/tools/tests/test_safety_invariants.py — planted failures for each rule (synthetic bundles), drift mutation tests over the real Swift file, and strict pins of the shipped bundle's current violations. The pins fail when a listed violation disappears or a new one appears, so burst11-fridgeluck-catalog-rebuild (which fixes the compiler and rebuilds the bundle) has a ready-made tripwire; when it clears the list, it updates the pins in the same PR.

Pinned findings (bundle at alpha ef236fcd, re-verified unchanged at merged head d4d79df9) — 12 violations:

• Rule 1 (unprovable True claims over unknown lines): rcp-000179 vegan (chipotle), rcp-000190 dairy_free (tamari), rcp-000207 vegetarian (baking_powder, sugar), rcp-000532 vegetarian + dairy_free (sugar).
• Rule 2: rcp-000179 claims vegan without vegetarian/dairy_free.
• Rule 3 sweep (6 rows, same four recipes): milk × {000190, 000532}, vegetarian × {000207, 000532}, vegan × {000179}, milk+vegetarian × {000532} — all blocked by unknown composition.
• Rules 4 and 5: zero violations (427 recipes carry thermometer checks).
• Advisory: 15 gluten_free oat recipes (rcp-000167 … rcp-000934), recorded for Sam, exit-code neutral.

How I checked it

• python3 -m pytest data/recipes/tools/tests -q → 76 passed, 1 skipped (the skip is pre-existing in test_pipeline.py), at the work commit and again at the merged head.
• python3 -I data/recipes/tools/safety_invariants.py → exit 1 with exactly the 12 pinned violations + 15-item oats advisory (the expected, pinned failing state); the CLI test also proves exit 0 on a synthetic clean bundle and exit 2 on a missing file.
• Drift detection planted: seven mutations of HouseholdSafetyGate.swift (remapped group class, dropped group case, dropped diet case, changed vegan blockedClasses, keto limit set non-nil, unknown screen removed) are all caught.
• Merged origin/alpha (f812dfde, 9 commits of guest-meal-planning work, zero file overlap) → d4d79df9; zero conflicts; tests and pins re-verified identical at the merge.
• git diff origin/alpha HEAD --stat shows exactly the two new files (+808 lines); grep for merge conflict markers: none.

What I couldn't check

• The Swift gate itself is not executed here (no Xcode in this environment). The Linux side verifies that the mirror tables equal the Swift enum lines and that the fail-closed markers exist; behavioral equivalence with HouseholdSafetyGate.screen comes from reading the Swift, not running it. The repo's hosted macOS CI covers the app build.

Assumptions

• A restriction without a corresponding claim (egg, peanut, tree_nut, soy, fish, shellfish, sesame, mustard, pescatarian) is never claim-admitted — the claim path fails closed, matching the gate's posture.
• Keto never claim-admits while ketoMaxCarbsPerServingGrams stays nil (drift-checked).
• The 11 pinned multi-restriction households are representative, not exhaustive; singles cover every restriction.
• The strict pins describe the bundle as of alpha d4d79df9. PR feat(data): repair catalog identity pins and aliases for pantry reach #192 also owns data/recipes/build/recipes-v2.json; if it lands first, this PR's pins re-validate — a changed bundle is precisely what the pins exist to catch.

Human author: Sam Gu (sgu07966@gmail.com)

🔗 Obvious Project · 🧵 Obvious Thread · 🔀 Obvious PR Artifact

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7ad50e23-bb09-4e0d-a727-54793e95e565

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codemetrics-ai]

Note

Review skipped

Codemetrics is installed on this repository, but it hasn't been added to your team yet.

To enable AI code reviews for this repo, go to your dashboard and add FridgeLuck to your team's repositories.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T12:37:46.815575Z	d4d79df	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.