The dish that says one thing and the recipe that says another.

A domain-specific assurance module that sits with the quality layer. It reads the whole menu, recipe and allergen corpus continuously, catches the contradictions — a dish flagged "gluten-free" whose recipe contains soy sauce, a guest-facing answer that doesn't match the source — logs the food-safety checks with timestamps, and blocks a bad edit before it reaches a guest. Allergen safety you can audit, not merely assert. Read by Eleanor Marlowe & Tommo Finch · against SFA guidance

Items continuously checked

Dishes, each cross-read against its recipe & allergen record

Contradictions caught this week

1 blocked before publish; 2 flagged for a person

Food-safety checks logged

214

Fridge, cleaning & allergen-station, timestamped & signed

Guest-answer verifications

486

uc10 / uc13 allergen answers cross-checked against source

Integrity checks across the corpus

Tap a column to sort. Each row reconciles one dish's published allergen claim against the ingredients in its recipe.

Dish ↕	Published claim ↕	What the recipe contains ↕	Confidence ↕	Check status ↕
Saltbush lamb tartarenative pepperberry · egg yolk jam	Marked gluten-free	Recipe step 3 folds in light soy sauce (contains wheat) into the dressing — and the dish already carries gluten egg on record.	100%	Flagged
Charred broccolini, anchoïadeside	fish tree-nut missing	Recipe finishes with macadamia; the anchoïade carries anchovy (fish, on record) but the published list omits the tree-nut.	98%	Flagged
Smoked Tasmanian ocean troutfermented bunya nut · dill	fish tree-nut dairy	Recipe lists bunya nut and macadamia (both tree-nut) and a cultured-cream finish — claim matches the recipe exactly.	100%	Reconciled
Crocodile boudin blancsauce gribiche · watercress	egg dairy	A boudin blanc normally implies pork — recipe confirms a crocodile forcemeat with no pork; gribiche carries the egg, the panade the dairy. Claim correct.	100%	Reconciled
Lamington souffléraspberry coulis · coconut sorbet	gluten dairy egg	Sponge (gluten, egg), crème pâtissière (dairy, egg); coconut sorbet is dairy-free. Claim matches; coconut noted as not a tree-nut under SFA listing.	100%	Reconciled

The headline catch. Someone added a "gluten-free option" tag to the saltbush lamb tartare — but the recipe folds light soy sauce (wheat) into the dressing, and the dish already declares gluten. A coeliac guest reading "gluten-free" would be misled. The guardian reconciles the claim against the recipe, names the offending ingredient, and proposes the fix: drop the tag, or swap to tamari and re-test. Colour never stands alone — every chip is labelled.

Food-safety audit log

Append-only, timestamped, signed. The record an SFA inspector would ask to see.

Timestamp	Check	Reading / detail	Signed	Result
03 Jun · 06:48	Cold-store temperature	Walk-in fridge — fish & dairy zone 3.1 °C (limit ≤ 4 °C)	K. Devi	In range
03 Jun · 06:50	Cold-store temperature	Dessert reach-in 6.4 °C (limit ≤ 4 °C) — door seal logged, moved stock, re-checked 07:20 at 3.6 °C	K. Devi	Out of range · resolved
03 Jun · 07:05	Allergen-station check	Tree-nut prep board segregated; dedicated macadamia mill cleaned & colour-coded before service	M. Finch	Pass
02 Jun · 23:18	Cleaning · close-down	Pass line, gribiche station and oyster bench sanitised; chemical dilution verified	J. Pereira	Complete
02 Jun · 18:02	Allergen-station check	Coeliac order — tartare flagged by guardian (see contradictions feed); GF tag pulled pending fix, guest re-quoted	E. Marlowe	Action taken

Verifying a guest-facing answer against the source

Every allergen answer the chat agents give is cross-checked against the recipe record before — and after — it reaches the guest.

Menu Q&A · uc10 → guardian cross-check

Source · allergen recordGuest-answer verification

03 Jun · 19:31

Guest asked "Is the smoked ocean trout safe for a tree-nut allergy?"

What the agent answered "No — the smoked ocean trout contains bunya nut and macadamia (tree-nut), as well as fish and dairy. I wouldn't recommend it; the Coffin Bay oysters are tree-nut-free."

Guardian cross-check The answer was reconciled against the trout's source record — fish tree-nut dairy. The "no" matches; the named ingredients (bunya nut, macadamia) match the recipe; the oyster alternative is correctly tree-nut-free. No contradiction.

Verified against source Answer accurate Released to guest log #CG-2091

The answer is checked, not trusted. A guest-facing agent can be fluent and still be wrong. The guardian holds every allergen answer against the recipe source before release — if the model had said "tree-nut-free", the same check that reconciled the menu would have caught it and held the reply. This is the assurance hook UC12 logs; here it is specific to allergens.

Break it: a contradictory edit, caught before it ships

A live edit is reconciled against the recipe source the instant it is saved — and blocked if it contradicts.

Menu editor · publish guardrail

Rule · claim must match recipe source Contradiction · allergen removal

Today · 16:54

The edit someone tried to publish Smoked Tasmanian ocean trout — allergens changed from fish, tree-nut, dairy to fish, and the dish re-tagged "nut-free".

Why the guardian blocked it The recipe source for this dish lists fermented bunya nut and a macadamia finish — both tree-nut — plus a cultured-cream element (dairy). Removing tree-nut and dairy, and tagging the dish "nut-free", directly contradicts the recipe. Had it published, a guest-facing agent and the printed menu would both have told a nut-allergic guest the trout was safe. The publish was refused before it reached a single guest.

Evidence on the block removed: tree-nut removed: dairy recipe: bunya nut recipe: macadamia recipe: cultured cream

Blocked at publish Never reached the menu or any agent Routed · Eleanor + head chef log #CG-2104

This is the point of the module. The dangerous failure in a restaurant isn't a clumsy sentence — it's a confidently wrong allergen claim that reaches a guest. Whether the bad edit comes from a tired human or a well-meaning agent, the guardian reconciles it against the recipe source before publish, blocks the contradiction, names the evidence, and writes the refusal to the same append-only log as the food-safety checks. It is a domain-specific assurance module that plugs into the UC12 quality layer — allergen integrity, not just general groundedness.

Under the hood What this is today — and where it should go next

Honestly, today this is a reconciliation pass over structured data plus a publish-time guardrail. Every dish has three things that ought to agree: its published allergen claim, the ingredients in its recipe, and the SFA's mapping of ingredient → declarable allergen. A deterministic check reconciles the first against the second and third; where wording is loose (is "boudin blanc" pork? is coconut a tree-nut?) an LLM resolves it against the SFA listing and a hand-built rule set. The food-safety log is an append-only table — readings, signatures, timestamps — and the publish guardrail simply re-runs the reconciliation on any edit before it commits. The append-only logging and tracing spine is commodity (it shares UC12's); the hospitality rules — the ingredient-to-allergen map, what counts as a contradiction — are the part that doesn't exist off the shelf, and they're the work.

On the roadmap

Recipes as the single source of truth. Today the recipe corpus is partly hand-keyed; pull it straight from the kitchen's recipe and costing system (the UC07 spine) so the claim is always reconciled against what is actually cooked, not a second copy.
Track the SFA listing as it changes. The ingredient-to-allergen map must follow Singapore Food Agency guidance; version it, and re-reconcile the whole menu automatically whenever the guidance updates so nothing silently drifts out of compliance.
Cross-contamination, not just ingredients. Move beyond "what's in the dish" to "what shares the board, fryer or mill" — reconcile the allergen-station log against the menu so a "may contain" warning is generated from the kitchen layout, not memory.
PDPA-clean by design. The audit log can capture staff names and, via guest-answer checks, guest allergy data. Self-host on SG-controlled infrastructure so nothing about a guest's allergy leaves the country.
A human still owns every block. The guardian can refuse a publish automatically, but a flagged contradiction is a queue for a person — the chef confirms the recipe, not the model. The check is fallible; that is designed in, not pretended away.

Where this sits in the roadmap — the expansion use-case brief: UC20 — Compliance & allergen guardian (expansion brief) → Sits with the UC12 quality layer → · illustrative data, not a live system. Expansion candidate (UC15–UC20).